It was the provider that handled the SMS gateway for posting tweets through the 40404 short code. The prevailing theory is that his account was hijacked using SIM swapping, and the hijackers tweeted through SMS. Cloudhopper is still the name of the "twitter app" that gets attribution for tweets posted through SMS.
I got some more intel on this -> unlikely sim swapped, probably just number spoofing. The "quality" of the "hackers" indicates this is the work of skiddies rather than an actual hack.
