The part of one individual doing all the accessing can't be right. The dude who reported it (on hn or reddit not sure) said he had his friend double check it.
They may just be counting those who were actively exploited, and excluded the cases where the guy and his friend were checking a few accounts. Since they reported it, it would be fairly easy to isolate their activities from other accesses.
Still, they should be more precise in their language.