Problem with the iCloud theory
OK, so assume you've brute forced the targets username and password, log into iCloud.com and... there's no access to the photo stream or device filesystems.
No problem!, just set up one of your devices to sync with their account details, and voila! a flurry of modal alerts are sent to every device attached to your targets account warning them that a new device has just signed in to their account. All these celebs ignored those alerts?