Wow... This is quite interesting. It is a good thing that this particular hackers had not malicious intent. It could have turned out very badly. I like iThemes Security they are quite good. The problem is most members in memberships site do not care much to create strong password and that causes issues for the site admins. I guess that's where plugins such as Force Strong Passwords come in handy.