Re: It isn't a excuse, but
I'd guess that they didn't transmit the photos by email but rather connected their email address to the services where they did send them (Snapchat, Messengers, ...) and the attacker simply used access to their email address to reset the associated passwords.
Or perhaps the attacker gained access to their iCloud or Google Account where their phones synchronize and/or backup every picture they take automatically...
Your email account(s) provide access to almost all of your other online accounts through password reset features and conveniently your stored emails typically reveal where those other accounts are as well.
Biting the hand that feeds IT
