I just don't get it.

A few months ago, my girl MS friend whose account I had info to got hacked.

-The girl quit MS, and I was the only one with info and I was the only one logging onto the acc.
-Girl didn't know email address password at all so she couldn't reset PIC.
-Girl did reset password after I told her the PIC got changed to her account (but not the password) and I randomly guessed PICs until I discovered it was 222222.
-Generally valuable equips off the main account were taken, no medals dropped, nothing deleted.

BUT THE PIC GOT CHANGED TO AN EMAIL SHE DIDN'T REMEMBER PASSWORD TOO.

It was crazy. Same thing as you bro.

A few months ago, my girl MS friend whose account I had info to got hacked.

-The girl quit MS, and I was the only one with info and I was the only one logging onto the acc.
-Girl didn't know email address password at all so she couldn't reset PIC.
-Girl did reset password after I told her the PIC got changed to her account (but not the password) and I randomly guessed PICs until I discovered it was 222222.
-Generally valuable equips off the main account were taken, no medals dropped, nothing deleted.

BUT THE PIC GOT CHANGED TO AN EMAIL SHE DIDN'T REMEMBER PASSWORD TOO.

It was crazy. Same thing as you bro.

back then, there was a exploit with the firefox browser and some firefox plug-in (Live HTTP header), that you could send the PIC reset email to another e-mail, but to do it, first you had to log on website using your account(or any account that you had e-mail info), then log on the account you wanted to reset the PIC (you had to know the login ID +pass to do it) and do the trick using the firefox plug-in, thats how ecko "hacked" the gm account. it got patched because the hacker that found it made it public and sent it to nexon.

 first link

http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=RESET+PIC+MAPLESTORY+EXPLOIT