Sounds like they just remotely root the device and then extract all data on it, with a special utility that can display the Whatsapp database in a neat way.