Most of these "hacks" are inside jobs. They come up with excuses so they can easily run away with users' money. I've seen it time after time and it looks like this will never stop as long as there are greedy people in this world.
You got a point there. Maybe not all but some are like this, havking is most likely done by there own developers who know the system of their sites.