[iam]

EA's Origin has similar problems, it's pretty easy to social engineer someone's account (tech support will reset your password and your secret security question) and then they can buy a bunch of games before you notice.

Apparently the security hole was that you just needed to provide the email and birthdate to the tech support, then they'd go ahead and reset your info.

At least there's no way to transfer the goods onto another account like there is on Steam (yet).

The worst part about all this is when you ask the tech support how your password got reset, they always say it's your fault (you got a virus, keylogger, etc) and never that it's theirs (social engineering, database lost, etc). Guess you gotta keep face.