Could someone explain how this hack works

My son was in the trading plaza and had the trade window open with "mr_thankyou" @Ranulph.42. My son, not thinking anything, had selected his 8 huges and put in all his diamonds to show this guy, not intending to confirm or anything. Then he got a message that said "I hacked you. Thanks for all the stuff" or something like that. My son was kicked out of petsim99 and when he logged back in all his huges and diamonds were gone. I'm just wondering how the hack works. Do they take the username and then just use a password generator to figure it out? Just trying to understand so I can help him in the future. We logged him out of every place through the app and changed his password to something much more complex. It's just frustrating that there are so many people that do this to kids. We also reported him, but i don't have much hope that anything will become of that. I'm not super tech savvy but am trying to understand how this works.