Current consensus theory is attackers used the admin panel to change email address to an account they owned, then used that to trigger a password reset and gain

Current consensus theory is attackers used the admin panel to change email address to an account they owned, then used that to trigger a password reset and gain control.