How was the hacker able to port the victim's number to another provider?

In the UK, the first step in porting a number is to request a 'Porting Authorisation Code' from your current provider. They don't give you that over the phone, but send you an SMS. So AFAIK you need to be able to receive SMS on the number already, in order to transfer the number to another provider.

So, was this hack enabled by a weakness in the US number porting process?

(In China, where I live, number porting isn't possible. Getting a new SIM requires you to physically present yourself and your passport or national ID card. If passport, the passport number must match the passport number they have on file, so a replacement passport wouldn't get around this requirement.)