To put it shortly: Most filesharing services use a psuedo-random URI to provide privacy. The thinking is that the URI will be difficult to guess, but can still be copied and pasted to share.
The researches just brute-forced all possible URIs to gain access to the downloads.