Usually done using a script to iterate through thousands of combinations after a common password dictionary search. Which means Apple does a terrible job of rate-limiting failed password attempts (or whatever service was hacked).