A "hack" is done because there is a vulnerable link in a users security. That vulnerable link may be the user themself (they might have been conned into downloading certain malware or giving the attacker certain information), or the vulnerable link might be the client computer's software/hardware (for example if the user was running open NETBIOS shares or a vulnerable web browser software), or the vulnerable link could be the servers computer (for example the attacker brute forced the password because there may not have been proper authentication policies, or the attacker could have preformed a man-in-the-middle attack because the server had a weak DNS server).
The problem is there are so many links in the chain of security and the attacker only needs to find one weak link to get in. That's why script kiddies like the dumbass earlier was able to somehow take over a users account, the odds are in his favor and thousands of automated hacking tools are distributed each day.