is it possible/plausible to hack hotmail?

[rst2]

Hi,
Just to be clear, I'm not asking for instructions. A friend claims that she had some important emails disappear from her Hotmail account. (four emails with financial consequences from the end of a fairly long exchange.) She claims to have used a strong password and strong security question, and to be very careful about always logging off. She also claims to be careful about what computers she uses. There are no signs of scam/spam emails having been sent from this account.

I have found several sites with instructions for hotmail password retrieval that look to me like phishing attacks. I have also heard that you can get programs to recall messages from hotmail (I have also heard that it's possible to whistle into a phone and launch a nuke...)

Short form, I believe that my friend is either dissembling, or made a mistake, but I'm looking for a second opinion.
Does this pass the smell test?

-- Fri Feb 01, 2013 10:45 pm --

Sorry, should have said crack hotmail. Been paying too much attention to the media lately.

[Irish Clov3r]

it's possible to hack almost anything as long as your smart enough to do it. Most likely she had someone around her maybe another friend figure her password out by knowing her pretty well would give them a certain list of what she might of chosen.

[centip3de]

it's possible to hack almost anything as long as your smart enough to do it. Most likely she had someone around her maybe another friend figure her password out by knowing her pretty well would give them a certain list of what she might of chosen.

Correction, it's possible to hack anything as long as there's an exploit. You don't have to be smart to abuse an exploit (finding one is another matter entirely), you just have to be able to Google.

@OP: It's highly plausible that she somehow got a key-logger, or was susceptible to a phishing attack, or possible social engineering. It's highly doubt-able, however, that someone found a 0-day and just went after your friend.

[LoGiCaL__]

Is she also careful about opening emails and going to any links sent from people she knows? Just because it's sent from someone you know doesn't mean it's safe.

[SarperAW]

Sounds like a classic case of shared password. Shared password means
that she use the same password across multiple sites, which is bad. In the
event that she was using the pass on a site owned by or is accessible by
the suspected party, then they didn't have to 'hack' anything. They would just
perform a simple copy/pasta and presto (no pun intended), they are in. Do
not be mistaken, this is still a form of social hacking and is HIGHLY illegal.
Tell your friend to start using different passwords for each site she registers on.

[rst2]

Just based on context, many of the suggested attack vectors don't make sense. The "accused" is someone with whom she has a business relationship only. There is no other human connection. The idea about shared passwords is very intriguing, especially if they have some sort of web based service to which she subscribes. I'll have to ask. Ditto to malicious links\attachments in a message.
Thanks.