In this case GMX would have to have a huge security hole that is not widely known, otherwise mass exploitation would probably quickly trigger alarms. Not impossible but seems also unlikely to me because it must be known to at least a couple of people and I would imagine that the knowledge about such a security hole would spread quite quickly once more than a handful of people know about it. And an inside job by several different people at more or less the same point in time seems unlikely, too. So the most likely scenario to me is still that only a single person broke the password and the multiple-people-have-access-story is just FUD.