Well, in order to get in through the DB, they'd have to first have access to it, and then crack the password. So, that wouldn't be my first thought.
It could be something as the user in question had an easy password or possibly their information was compromised. Probably need to look through the access logs to see what all the IP in question was doing to get an idea.
