1. Yes 2. Yes

AM took the unencrypted password, lowercased it, and hashed it into an MD5 token that they then stored - conjecture is that it was used as a login token. That is what the article indicates was cracked, since MD5 is very weak, to get a lowercased password, then tried every permutation of capital letters on the bcrypted passwords, to get the actual passwords out.

To avoid similar issues, if you generate a token, don't use the unencrypted password as part of it. Random tokens are fine.