A wild guess: they found an XSS and used it to steal a Dev cookie. Then used that to grant mod status to a throwaway user.