Yup, perhaps they put the username of the logged in user in an encrypted/signed cookie, and the private key was in the source code.