I thought the wallets couldn't be hacked.

He has a 30% success rate. That's pretty high.
the 30% success rate well explain that this is uncertain and probably just using a common method like forget your password or anything similiar
probably, that's good enough.
but how about if the owner of forgotten wallet password forget everything about the wallet. I mean he should have a thing like phone number or email for example to be sent the new password. CMIIW