[morphball]

I thought I was against colluders once on stars playing Omaha, and they sent me an email along the lines of their security staff can watch the hands and see every one's hole cards. (I have no idea if this is in real time or not.)

If these "security" accounts are in real time, do the poker rooms allow the security personnel remote access or only on-site? If they allow remote access, then there is your hack.

Even if a pokerroom's staff is not allowed remote access, if their staff's security computers are otherwise connected to the net, which they are as they can send you emails, it could still be done.

My hunch is that AP already knows which security account was compromised, and that they have shut that particular account down. AP will never admit to it, nor will AP do anything that would even look like it acknowledges something happened--like giving back refunds.