Fansites, completely legit and harmless, get hacked all the time, their list of users and passwords stolen and often the Admins don't even know. And the majority of people dislike remembering multiple passwords so they tend to use the same few over and over, as such the hackers out there have huge lists of account names, emails and passwords.

Not saying that is what happened here, just that it happens. Is there no smartphone key app?