I verify accounts all the time. By phone. I have an account number. The account number matches. The other guy doesn't have the account number. He fails step one. And that's a dead-simple, no-brainer level of implementation. It seems negligent to not even have that.
Every part of my business is involved in an account- from office supplies to banks to payment solutions.
It's not a huge burden at all for the business- and it's one that they certainly should be willing to bear.
I think it can be clearly shown that there is a reasonable level of expectation that any company would seek to ensure that they are interacting with an agent of a company.
Do you really think that if I were to walk into your bank, say I was you, withdraw all of your money, that you wouldn't be just a little pissed off that the bank simply took my word for it? Hell, I'm the founder of my company and when I withdraw from the company account I have to prove I have the right to do so.
I'll reiterate: this submission may not be telling the entire story. However, if it is, I think Apple should be made to repair damages in a very precedent-setting way, so companies are held to some reasonable behavioral standards.