they experiment possible exploits in the protocol.

they ran a lot of client from the same ip with superb network speed.

a lot of nodes connected almost exclusively to them, so they got all the notifications and forwarded them.

so it looked like all blocks came from them.

they hoped, that they get the block reward for that.

seems they did not really read the protocol.