It's not proven, but honestly, that doesn't matter. This is all about public perception. If it feels like Apple did something wrong, they might as well have, at least as far as their PR response ought to be concerned.
But, I totally agree that this U2 move was absurdly ill considered.
Google recently stated that the 5 million sets of Google account credentials were not stolen directly from them and only 20% of them were valid. Is this also 'unproven'?