If it's as they describe they did have a 0-day used on them. The email attachments, which were excel spreadsheets with an embedded flash exploit apparently were the source of the 0-day report documented in CVE-2011-0609 and published on Mar 14. The RSA attack was reported on Mar 17.

https://www.adobe.com/support/security/advisories/apsa11-01....

While there is definitely something to be said for what you're saying about "omg, email attack" the other side of the coin is that spearphishing is the most popular/common attack vector because it works.