This sounds like a weakest link in the chain story, with mail.com being the weakest. The article does not say if the mail.com password was weak but if could have boiled down to a weak password.