> Specifically, on July 25, 2016, Kazzelbach created an e-mail account that mimicked the victim’s real e-mail address and within 10 minutes, changed the name on the victim’s Apple account to the fake e-mail address he had created. Two days later, Kazzelbach initiated a password reset, locking the victim out of the account which controlled certain settings on her iPhone, as well as access to the photos, music, and videos associated with her account.

He did what? How? This sounds extremely bad (in addition to the rest of the story).