They may just be counting those who were actively exploited, and excluded the cases where the guy and his friend were checking a few accounts. Since they reported it, it would be fairly easy to isolate their activities from other accesses.