They probably brute forced his password given a copy of the private key file and didn't want to disclose that method.