Comment by sleepymountain

His Amazon account wasn't even logged into, the CS rep gave up his information without the attacker being authenticated, and the attacker used that to login to other non-Amazon systems.