I agree, it's amazing how stupid criminals can be, even online. It's scary to think what someone as smart as these security researchers could do if they went black hat...
An off the shelf key logger is used; a couple of stolen email accounts, and a spammer is used for delivery. There are automated tools that will pack the key logger executable in a word document also.
As for the part of the security researcher; reversing .net code isn't challenging. This is by design - the framework does not obfuscate or make it challenging to look at the code. The author of the key logger could have built in protections or obfuscated his executable but for one reason or another has not.
Most likely all of the reversing or analysis was also done with automated tools, and the analyst simply had to run them. OfficeMalScanner can be used to locate packed executables in MS documents and extract them, and then it is simply a matter of dumping the binary in the .NET decompiler of your choice (the author uses ILSpy, I personally prefer RedGate Reflector) and looking at the code.
IMO this is a marketing piece that happens to have an interesting story attached to it.
Criminals come in all shapes and sizes, at all levels of intelligence, skill, and laziness or lack thereof. There are indeed criminals who aren't stupid but are lazy; but in my experience counseling the incarcerated, most criminals (that I spoke to in a non-scientific, non-random sampling) were both stupid and lazy. Of course, maybe that's confirmation bias, because I only spoke to the criminals who got caught.
What I found most fascinating were the criminals who were smart in the short-view, stupid in the long-view, and extraordinarily not lazy. Many young hackers fit into this category. They work long hours and invest a lot of effort in a crime, thinking all the while that the investment had a better return than non-criminal activity over the long-term.