If that's the requirement, isn't that a poor design? I knock out one or two points in the city and the sirens are unusable?
I assumed that the hackers injected their command via radio, which I still think is likely based on getting the FCC involved, but with POCSAG involved there's definitely another possibility. A lot of pager systems might have a fairly exposed way to send in messages - a phone number you can call, an email address, perhaps a poorly secured web interface. The hackers might have figured out what pager numbers the sirens respond to by listening in and then sent their message via "legitimate" means like an email-to-pager gateway.
You can do this pretty trivially with HAM gear, although some may require small modifications to allow transmitting on the necessary frequencies. You can also often buy the equipment on ebay ready to go.
I sort of felt (in my ignorance of such systems) that this would have been somehow relayed / repeated instead of being a broadcast across an entire city but I didn't want to speculate as I'm clueless on this kind of tech.
I know it's a nuisance, but this is the sort of thing I daydreamed about doing when I was 13 so I can't help but be kind of entertained by it (at least while the only fallout appears to be knocking people out of bed).