I don't understand how step 4 was achieved. How did they get a list of recent transactions? Or does the password reset functionality ask you to verify certain transactions?
Sorry, I still don't see how the attacker would have seen the information necessary to do that, unless the victim's answer's to questions over the phone enabled that.
