On iClassic? It's not as simple as getting a password, you have to verify every single new IP/device by email, so someone would have to both know your email and have the password to it, and they'd have to be able to get into your email (which means you have no two-factor authentication or other protection)

I'm sure what happened with Miracles is the same as what happened with every "hacked" 1k guild, which is that the leader shared account access or leadership