It seems significantly more likely that the "hack" was in the account recovery system which allows -- via a couple of often easily discovered personal details -

It seems significantly more likely that the "hack" was in the account recovery system which allows -- via a couple of often easily discovered personal details -- a complete, immediate account takeover.