The most important lesson here is that no amount of security on a website/server/physical piece of hardware will stand up to the test if the user is lax in their usage.

Social engineering is the new wave of security breaches and it would seem that strict password policies etc are just as important as an intrusion proof system/network.