They said in their first comment that their drivers license had been stolen in the mail, which is what started all of it. I'd imagine they either went and bought their SSN from someone who had a collection of them from hacks or they used information they were able to get from places that ask for verification but show a few digits (e.g. "confirm your SSN: *-*-1234") to narrow down and then brute force different numbers at different sites until they got it.