The study took some of these public DNA samples, and searched genealogy databases to find likely relatives. The self-reported surnames were thus those of distant relatives, not of the PGP-participants themselves. The researches then combined those likely surnames with information such as zip codes on the PGP public profiles to correctly identify several participants (given that a zip code, gender, and surname is often enough information to uniquely identify a person).
It should be noted that the PGP has a rigorous education and consent process of the risks of publicly posting DNA. So while the study may have surprised some of the participants, it's not something any of them were expecting could never happen.
You can read more info on the study here: http://www.wired.com/wiredscience/2013/01/your-genome-could-...