Probably something like 1 in 10 of the Gmail users examined have weak / short enough passwords that by knowing the length the dictionary used becomes small enough that a brute force attack becomes feasible.
It doesn't say how they get the Gmail address to correlate back to the known length password though.
I see the "light on details" reasoning, but it doesn't go well with the sensationalist "1 in 10 Gmail users."
Surely Google doesn't allow high rate guessing, they must throttle or temporarily disable targeted accounts.