NASA (and the federal government in general) has been pushing pretty aggressively to transition the entire workforce towards two factor authentication (password + PIV card), so either this happened on a system that hadn’t been transitioned to requiring PIV cards yet or it was an exploit of some kind.