The commands are likely brokered through a cloud based service. It sounds like the OnStar hack captured the authentication token and used that to talk to the ce

The commands are likely brokered through a cloud based service. It sounds like the OnStar hack captured the authentication token and used that to talk to the central service to send commands to the vehicle.