I remember a lot of low number ICQ accounts being taken over back in the day, including my own and several security-minded friends. Because of how prevalent it was and how it was the only account we'd had compromised we assumed they found a flaw or had access to reset passwords, or could social engineer support etc.

It's good to finally know there was a critical flaw like the one in OP that was likely used.