Sorry, I went back and read a bit more closely. It turned out that the victim had signed in to a website using the same password as the password that she uses for her own site. The webmaster of that other website then used that password to access the victim's website.
Guess that other poster was talking out the wrong hole then!