I would guess it's a phishing/brute force scam, and the address change is (as mentioned in the article) just a way to validate that it worked. I would say that

I would guess it's a phishing/brute force scam, and the address change is (as mentioned in the article) just a way to validate that it worked. I would say that Apple's actions around refunds are just a simple way to make sure they don't take too much bad press while they try to find a way to prevent this from happening.