@mat: Wow. Okay. So I've confirmed with both the hacker and Apple how this happened. Was via a phone call to Apple tech support. 
As Mat’s case demonstrated, we’re often only as safe and secure as our passwords.
If one edits a document than does Save As, then both the edited original document and the copy are saved, thus not only saving a new copy, but silently saving the original with the same changes, thus overwriting the original.
Culturally and technologically, we have certainly come a long way from plain-text passphrases stored in a file, but it’s clear there is a lot more to be done. In the mean time, I’ll just be here fumbling with my phone every other minute, cursing Apple as I bask in a moderate sense of security for having jumped through all these hoops.