Occam's razor supports this one. Which would also bring liability to Twitter for not taking adequate steps to secure their servers.

It's not like they get l337 h4xx0rs to pwn their internal systems; they probably just have login credentials or permissions they shouldn't have, which aren't audited, and they can sneak things out in plain sight.