Looking at GMX's password recovery process, to recover an account it looks like they will either send an email to s***@v*****.com
or they will let you enter your birthdate. Perhaps somebody exploited one of these two options?
reddit formatting markdown fucked up the email address characters, but it looks like S followed by 6 stars @ V followed by 8 stars

entering birth date is rate limited to 3 attempts per 24 hrs. So probably wasn't accessed through this unless the attacker had narrowed down the range a bit

the ironic thing is that he posted this link along with "that's a little overboard" on his facebook http://nationalreport.net/15-year-old-swatted-domestic-terrorism/

he's got to be wondering "shit, if this kid swatted someone and got 25 years, what the fuck will i get?"

also, i've been checking out profiles of his friends (they are hilariously like him.. skinny kids who listen to hip hop, watch southpark/jackass and wear baseball caps).

...

The "forgot your password" security question on Satoshi's gmx email is "what day are you born". With no lockout mechanism for brute force attempts, 36500 possible answers for anyone alive, and given a bot that can guess even 5% of the captchas shown, it's no surprise that it was compromised by anyone determined.

There is no information in the site's TOS or documentation about unused accounts expiring, so this is the likely mechanism.

...

13.3. You agree that in the event that GMX determines, in its sole discretion, that you have not logged in for more than six months, GMX may without any liability to you, and in addition to any other remedies, erase such materials from GMX's Equipment without prior notice to you.