[adambowles]

They logged in with the newly reset password.

[jonnycomputer]

Sorry, I still don't see how the attacker would have seen the information necessary to do that, unless the victim's answer's to questions over the phone enabled that.