According to Wired's Threat Level blog, the suspect is 35-year-old Christopher Cheney, a Florida resident who is now facing 26 counts of "accessing protected computers without authorization, identity theft, damaging protected computers without authorization, and wiretapping." And from what Threat Level is saying, Chaney's techniques were somewhat unsophisticated.
The FBI says Chaney used publicly available data about his victims to help him break into their e-mail accounts. For most victims he would then secretly set a forwarding address so every incoming e-mail would be forwarded to an account he controlled.
Chaney allegedly broke into Johansson's Yahoo account in December 2010, just a month after he'd gotten into Harouche and Augilera's accounts at Apple's Me.com email service.
Moral of the story: check your email forwarding setting every now and then, yeah? [Threat Level]