WP 3.3.1 – Infect iframe inserted in posts without hacking core files

Hi,
we’re running a 3.3.1 wp installation with the default twenty-eleven theme and the wordtwit plugin on.

We found an iframe linking to malicious pages inserted in 3 posts.
Looking at the posts revisions, we saw that the code has been added logging into the account of one of our editors.
No core files have been modified.

The same exact thing happened to this guy https://www.quora.com/WordPress/How-did-this-hack-happen-an-Wordpress-iframe-insertion-in-a-post

This is the log: https://pastebin.com/MVHretfb (ps. I replaced URLs and IP addresses with placeholders)

Taking a look at them, do you think it’s just that somebody stole that editor’s password or could it be a wp 3.3.1 vulnerability?

Thanks!