They exploited the fact that people didn't change the default passwords on their voicemail (e.g. 1234) and so were able to access them remotely using the same system a legitimate user who needed to access their voicemail remotely would use.