Based on the screenshots and Okta's description (which absolutely needs to be more clear), the attacker couldn't directly change passwords, they could only trigger password reset emails.