Surprising velocity? It appears the hackers had the oauth key for a month.