Most exchanges don't use a single wallet per user, but have a small pool of wallets that all their customers share, and they just do the bookkeeping of the balances of each account. That lets them group many transactions together into a single larger transaction, or avoid a transaction entirely if it's between two users on their exchange.

So that pool of wallets that stores all their customers funds needs to be managed by the exchange somehow, meaning there's going to be some sysadmins/devs/etc that have access to parts of the system that deal with those wallets, and possibly also the keys to those wallets (which it looks like was the case here).