Btw a technical detail: they didn't only swap 'p' for 'q' in the address; the checksum (the last 6 characters) is also changed. Which almost certainly means they just swapped out the existing scriptPubKey for one where the version byte was changed from 1 to 0, and then their software created the 'correct' address for that, including the new checksum.