Can the Blizzard Authenticator be hacked?

My friend and guildy had a lvl 80 undead mage on my server. He bought the Blizzard authenticator as soon as it came out and used it successfully ever since. Never lost it. Never broke it. Always carried it with him and guarded it better than his wallet. Which is why he was so shocked when he couldn’t access his character a few weeks ago. He couldn’t understand how someone could hack him if he has the authenticator with him at all times.

He logged into his Battle.net account online successfully. As you all know, this requires entering your authenticator code. And the account showed that no game was associated with the account at all. Here he realised that only Blizzard could do this. He was surprised they did it without even letting him know. So he emailed them the accounts team.

A game master, Eolaande, replied and confirmed that: “We have determined that the World of Warcraft account <NAME> has been associated to a Battle.net account accessed by someone not authorized to do so by the Terms of Use”. He suggested several security tips, including getting a Blizzard authenticator (ironic, right?)

This raises several questions:

1) Here we have a Blizzard employee saying that an account that has been protected by the Authenticator has been accessed by a non-authorised person, i.e. it has been hacked. Is it really possible to hack an authenticator-protected account without having access to the Authenticator?

2) Is it normal policy for Blizzard to delete WoW accounts which they suspect have been accessed in an unauthorised way, and to not even inform the registered account owner my email?