As most people have identified, this looks like the owner was back in control of the account, but the hijacker had set Authenticator which was still active. It's possible that the person Tweeting was the Auth setter but didn't have the current pass, but less likely because the owner can just set a new pass if they wanted to.
Often a 'hijacking' is actually a share gone wrong, and although I'm not saying that is the case here, it is common for 2 different friends to look quite similar in an account history, especially if they live close to each other.
It's not always really clear if we should remove the Authentication, as sharers often ask for the other sharer to be removed - and as there is no way for us to verify who someone is on Twitter, the advice to remove the Auth would guarantee that the person doing so has access to the active recovery email.
In fairness, although the advice is sound, we could have been a little clearer in our response, so we'll tak...
Read more