If they used a good hash it would be basically impossible. I'm thinking someone got sloppy and used a hash that wasn't so good, or used only part of a hash. (I've done the latter deliberately--folded the hash down to a 32-bit value accepting that a "hit" meant go to the disk and get the whole record to check. The occasional false positive cost less than the additional time spent reading the bigger hashes as I had millions that needed to be loaded into memory.)