What I don't understand is this part..

I was able to give only an old, supposed to be expired, session ID to a friend and they were able to log into my account and characters from an entirely different location in the world. I did not provide an account name, password, or one time password.

How exactly did his friend log into the account without account name and password?