I'm don't know exactly what he did of course, but it's very much possible to do lots of things without going into your account.
Each game has a name and a unique ID. Also, each game is 100% predictable/deterministic as long as you know the moves that are scheduled. This means that once you've scheduled an order, the devs can view the game and see how those orders will play out, also maybe without the fog of war as to include orders of other players.
They've paused a game I was in, in order to fix a bug in our specific game, after which it was unpaused and we could continue playing.
So there might be (maybe, maybe not) a difference between taking a look at how things look from your point of view, and actually accessing your account information. I'm hoping they've got passwords stored securely.