Very strange set-up
Firstly, that "fewer than 10" comment is hilarious, that's just indicative of the amount of people who just happened to access the Three website using someone elses hotspot AND bothered to report it.
I set up Three wireless broadband for my ex, and although on good terms, there's physical distance between us, so when I get questions about it being down etc, two things have struck me as being strange practice. Firstly, you can only reset a MyThree password if you have access to the sim card, which presumes said sim card is in a phone and able to receive messages? Secondly, and more ironically relevant given this story, you can only access the Three mobile app when connected to your (although I'm now presuming any) Three connection. Want to check your bills etc out of home, forget about it. The set-up seems oddly backwards.