They're not guessing passwords, they have a list of e-mails and passwords from other leaks and are hoping the users are using the same credentials on all their accounts. Since password managers aren't mainstream yet it works.
> The researcher added that he discovered another issue where someone could enter a 23andme profile ID, like the ones included in the leaked data set, into their URL and see someone’s profile.
Amazingly incompetent.