I think a lot of it was social engineering and bad passwords. If you are using multiple services and one is compromised you can pretty much give up access to everything if you use the same password all around.