My bet is that some Tweet posting API is missing a critical authentication check or the hackers found a way to bypass this check.

I doubt someone could individually hack all these accounts.