friend's account hacked on Absolute for thousands

[mosta]

A friend of mine who is along time middle limit player (like long before
the online era) just got hacked on Absolute and got taken for several
thousand. They also got into his Paypal and Neteller accounts (but
lost nothing b/c no money in the first and second is frozen). He
primarily uses a laptop but also has a desktop that he hasn't used
in months. He has one roommate who he says he trusts completely
and no one else was in the house--he thinks he's sure.

He says Absolute investigations determined that the activity
came from his IP and his MAC address, corresponding to the
desktop.

How possible is it to fake an IP and MAC for a hacker?? Or does
he need to reconsider who may have been on his desktop?

Note, I think the passwords were not changed after the hack.
On AP the guy lost a lot randomly, seems to have dumped some
to one guy maybe, lost a lot on blackjack, and put in a withdraw
request to a new processor account which they managed to cancel.