Probably they phished the logins otherwise. Normally those sms are the second factor.