His Amazon account wasn't even logged into, the CS rep gave up his information without the attacker being authenticated, and the attacker used that to login to other non-Amazon systems.