The purchases seem to be made using things like browser-stored passwords/login cookies, or if nothing else the password reset and access to an email client with

The purchases seem to be made using things like browser-stored passwords/login cookies, or if nothing else the password reset and access to an email client with stored login info. I don't think shared passwords are being reused once inside the session, mostly because why would you need to hijack someone's box to do so? Just log into Amazon from wherever. They might be used to get into the remote session in some cases, but a lot of people who otherwise seem educated on the issue seem pretty convinced that can't be what happened to them.