Comment by lrm242

The way he was able to add his key was via a web-based exploit, which effectively gave him administrative web access. So yes, the list is correct.