just to be clear, the default permissions on Google Forms do not allow anyone to edit the form just by adding /edit to the URL. the owner of the form has to eit

just to be clear, the default permissions on Google Forms do not allow anyone to edit the form just by adding /edit to the URL. the owner of the form has to either (1) specifically add individuals via email address, or (2) change "general access" from 'Restricted' to 'Anyone with the link'. that is the only reason the "hacker" was able to edit the form. TL;dr the owner of the form changed the permissions to be literally wide open. you reap what you sow.