This is Zee from The Next Web. Just woken up to this and have personally spoken to Matt Langley the person in question who - after some convincing - explained the entire process to me.

It is indeed not a massive security vulnerability but a much smaller one. We're updating our piece as we speak and can only apologise that we published before being absolutely sure of the level of the treat.