Presumably after the hacker compromised the CEOs email account he had access to any account he wanted, as I interpret the blog post he was only able to use that access to compromise a single account before being locked out.

Nobody is necessarily lying.