How they detected it can be found at the bottom of the blogpost:
> *Indicators of Compromise*
> ...
> Okta activity for a user without any clear indication that the user authenticated (e.g. a user.session.start event for that user from a similar geographic area)