No disrespect to Andrew, but any self-respecting web security professional would have cleared those tokens and asked him to require new logins from people as a matter of course in response to the first breach.

There legit is not a good excuse for allowing this second incident to occur.