This happened over a Thanksgiving Holiday weekend to my girlfriend. After crying on the phone to EA and eventually getting through to someone who wasn't clueless, it turned out that this is EA's default behavior for dealing with hacked accounts. Her account had to be restored from a backup.