I recall there was a followup to the article that confirmed that he had granted access to his gmail (or someone in his network etc). What the article describes should not be technically possible.