F2pool probably doesn't use the default getblocktemplate from core, because BlockAssembler does indeed track the number of sigops for the transactions it includes in the block, more details could be found in validation.cpp

It's the first time I hear about this incident but I am not surprised because F2pool censorship transactions based on OFAC list, which means, they did alter the code that creates their blocks, so somewhere along the line their devs failed, and ended up screwing things massively, good for them -- they deserve it.