Considering that Instagram doesn't provide any support (that I can find, anyway), social engineering seems unlikely. Unless they found someone who worked at Instagram and somehow socially engineered them to transfer the account?