There are more ways to "recover" an account without putting sensitive information on your computer. The perpetrator could of instead been around the computer that has a history of the account's loggin and installed a software discreetly without the owner knowing it was downloaded. The perp could of been an acquaintance or a friend of the hacked person. Second of all, he could of been phished out of his details but overlooked it. There are plenty of people who do stupid things on the web but doesn't want to admit it in public. Seriously, who really wants to tell to everyone who's reading this thread, "Hey, i got hacked because "Jagex" sent me a false representation mail and i decided to check it out but it stole my password and everything instead."