He mostly used social engineering. Not technical exploits. So that's how he succeeded. Call it crazy, but it worked.

Why hack a password when you can get the employee to just tell you.