Or more realistically, accessed the accounts via IAM token and/or service account.

Something they also failed to consider, reading between the lines.