For the impatient, what they did was: put a zillion DNS registration accounts into a limbo state where anyone who knew, or could guess the email address associa

For the impatient, what they did was: put a zillion DNS registration accounts into a limbo state where anyone who knew, or could guess the email address associated with an account, could supply that, and a password of their choice, to gain authentication credentials valid for the account because they stored the supplied password without any verification that it came from the owner of the associated email address.