I seem to recall from an article on this incident that I read some time ago that the gym's system was really insecure (like, anyone accessing the right URL could mess with it levels of insecure.)