Their explanation seems very similar to what happened at CoinPayments recently, where hackers were able to withdraw Ripple from other people's accounts - even more than what was on balance.