Also if the iCloud account in question was pointing at the perpetrator's work email address, the city would have been able to do an email reset.