Yes, if someone sets a passcode and then forgets it, they will be locked out forever and lose all of their files. There is no way to prove physical ownership of the device, pretty mich the passcode proves who the owner is.