Keychain can't be hacked because they don't store any keys, this means that someone had to have gotten his key, possibly the site he stored them on - google docs could have been hacked. It's well known that google docs, even gmail can and does get hacked at times.