Seems like it's possible that the user's phone number was hijacked? In that case SMS verification actually makes their account less secure because it can become a single point of failure.
Could have been hijacked for a brief time, or could have been attacked through a network exploit that duplicates all SMS'es and reflects the copies to an attacker ...
