It is incredibly simple to take over the SMS functionality of any phone number in the US. It's crazy how easy it is.
It's worth noting that this is one more case of a USA-specific problem caused by inability of commercial providers to securely verify identities of people; the same thing is much more difficult (though still possible) and thus very rare elsewhere.