You don't think there were MANY accounts that logged in from new locations in that time frame? Think wireless networks...
I simply refuse to believe that with such a gigantic service they could determine that only X and Y were compromised by "one person" so accurately and so quickly--especially considering they haven't even implemented a build/deploy-time test suite that, among many other things, asserts that something like the auth system works actually works.
Your suggestion is pure speculation like you say, and, really, any application that logs something like "invalid auth" usually(!) immediately aborts the session (since that's the logical thing to do); it doesn't continue it...
You don't think there were MANY accounts that logged in from new locations in that time frame? Think wireless networks...
I simply refuse to believe that with such a gigantic service they could determine that only X and Y were compromised by "one person" so accurately and so quickly--especially considering they haven't even implemented a build/deploy-time test suite that, among many other things, asserts that something like the auth system works actually works.
Your suggestion is pure speculation like you say, and, really, any application that logs something like "invalid auth" usually(!) immediately aborts the session (since that's the logical thing to do); it doesn't continue it...