Attacker had access to the account. It is in the complaint posted by user iancarroll.