Why can't GMs lock accounts?

As I write this my friends account is being hacked, all his items being stolen and sold. We talked to a GM while this was happening and all he gave us was the Blizzard phone-number even though they are closed. I don't find this useful at all. Why does he get to get away with this, when they could simply lock his account now so the hacker doesn't get the satisfaction of taking all these items. I would very much hope that this is not so he gets what he needs and this gold and what not and then finally gets sent to those gold-farming websites. Why are authenticators not free? Despite if they're only four dollars or whatever the price may be this seems to be happening more and more. Considering what we pay for a month perhaps it should be free? Or even given out with the next expansion.