Those account can only be started if the scammer has the details to do so.

In each case the scammer would have sent a phishing Email to the person and that person would have given

the scammer the sensitive information needed to open an account.

They generally ask them to log into an account to verify details.

They know the Email address is live as the person clicked on the link embedded in the Email or downloaded

Malware.

In the case of the account being hijacked a second times it definitely points to a Keylogger or Trojan so you

need to:

Watch out for more spoof or phishing emails you may get and as a precaution ,run all your spy ware and virus   protection and change your passwords.