Lets not assume that the hacks used were simple. EVERY system can be brought down some how.

My home network is VERY secure. Port scans only show one active port, and that is an out going port only. Pings to my IP are dropped. My computer barley exists on the internet. Yet someone still got a Trosian on my system.

Its not hard to think that Valve could have had a key logger put on its systems. Though i dont think any computer with the code, or the game should have been connect to the internet in any fasion. There mistake.