GitHub has rate limiting in place (for user logins), as it demonstrated when it counter-intuitively locked me out of my own account while I tried to regain access. The fact that multiple accounts were compromised through this attack (despite their rate limiting) and that it would be literally impossible to guess my password sans quantum computing indicates _their_ password was compromised, not the password of any affected account. The solution is for them to use proper password security.