[HarryT]

Originally Posted by scottjl

what is most likely is that the users simply had weak passwords.

Or that it was a phishing attack. That, according to what I've read, is regarded as the most likely source of logon credentials.