There are some safeguards like the recovery account and the different keys but if both main and recovery account gets hacked it's probably that there was a direct access to the computer. I can't explain it otherwise...