I read the article and my list of possible explanations are correct.

Resetting passwords by email address alone(no DOB) is a standard way of starting a two-phase authorization.

If you read the forum thread that Kotaku linked to, you can see that someone received an initial email that said something along the lines of “Click this link to reset your password”.

Normally that’s where a fraudulent password reset request would end unless someone had access to a user’s email account, however seconds later they received another email saying the request was completed.

Sony just stated on their blog that this was a “URL exploit”, so now I present two other explanations which I forgot to list.

4. Sony set their script to automatically bypass the second phase so people wouldn’t have to check their email account.
Heads should roll if this is true, but I doubt it. Why even make a two-phase auth system if they’re going to bypass it themselves?

5. Sony let blank auth keys reset passwords (the official explanation?)
Maybe the programmer accidentally put something like a = instead of == for matching… But the structure of the links make me call bull on this.