Why do you think he "only" downloaded the source ? He wrote:

    I got 1.2 GB of data to go through. The data-set
    contained:

    Wordpress configuration files (yes, they use Wordpress)
    including hashed user credentials for the backend login
    
    Database passwords for production databases

    Log files

    A lot of PHP source code
    (who could have guessed?!)

    much more …