I think the key phrase would be "Someone needed access to a citibank account..." If some Citibank account(s) was compromised in some way, such as phished, then a third party would have the necessary access. It would be bad enough to be a victim of phishing--imagine being a pawn in a large scale attack like that. It would suck.

I'd bet they used one of the hundreds of thousands of stolen accounts from other services to do this. You know somebody is sharing usernames/passwords with their SOE and Citi accounts.