Mainly they exploited the fact that the FindMyIphone website did not throttle the number of login attempts. So you can do it as many times as possible. Apple deflected this by "denying" that any usernames or passwords were leaked, but in reality it is their fault that the accounts were compromised.