They way I understand it based on the article is that they were only able to change the email address, then used that to reset the password and log in.