Hacker News Reader

The hackers could be creating an API auth token after getting the first password. So you change the password, but the auth token is still valid. They can't use the normal Twitter interface, but they can do whatever the API lets them do...send tweets, etc.

I suspect social engineering. it's pretty common these days for everyone to give live sessions to connect with their followers and keep answering personal questions. Don't be surprised, when asked by the followers, most of them are ready to share all personal details from dob to mothers full name. I have noticed many times, the accounts got hacked right after a live session.

I don't have first hand knowledge, but if I had to guess, likely social engineering customer support.