So they had weak passwords? Or were their accounts recovered/reset via SMS which is prevalent but not 2nd factor login.