I feel like it's more likely someone got caught by their org noticing their credentials being used to dl ridiculous amounts of papers, and fell back on the "wow, that's so weird; I must have been hacked" excuse.