Nope, they chose their hosting service.  If they chose a hosting service which allows password resets without adequate verification, that's on them, not the hosting service.  It'd be interesting to know if there was a more secure option available to them with OVH and they simply chose not to use it (which has happened in the past with other intrusions - the services haven't paid for full database back up or haven't utilised all the security options available to them).