Being a contributor does not mean he has push access to the rails master, it just means one of his patches/pull requests got accepted into Rails in the past.

In fact, it's even better: the commit he pushed into Rails's master through the exploit would have automatically added him as a contributor even if he had not already been one.

The point of his hack was to _make_ him a contributor to rails.