The article says they got access to victims' email accounts. I wonder how.

this would be helpful to know - possibly from the Ledger wallet data breach?

Sadly that isnt discussed.... it would have been nice just to know who people like him were doing to protect yourself