Oha:

As more details become available, it seems what happened is that a Twitter administrator (i.e., employee) gave their password to a 3rd party site because their API requires it, which was then used to compromise Twitter’s admin interface.

Aus der sehr interessanten OAuth/Twitter-Diskussion bei Simon Willison.