Apparently it was the Twitter admin help desk application that was hacked. It's been taken offline. The phishing was separate.

"It will be good for the people calling for more secure, standards based authentication on Twitter and elsewhere around the web." [from article]

"it is important to note that OAuth would not have prevented either of these attacks" [from Twitter]

I see the point for OAuth third party applications, but that's not the attack vector here. That's just free association. What more secure authentication do people want? Client certificates? Dongles?