I believe they probably found a way to inject some data that wasn't properly escaped. When the CEO (or anyone else) would receive the alerts that someone was t

I believe they probably found a way to inject some data that wasn't properly escaped. When the CEO (or anyone else) would receive the alerts that someone was trying to break into their accounts, the XSS or javascript (or whatever) would be included in the alert and executed ... That's probably how they broke into it and why it didn't work with noscript enabled.