The going idea is that they counted everything right, sent it overseas to be changed then received the changed votes.  So the code looks fine, but the sending and receiving allowed it to overwrite data when it matters. It's a middleman attack.