They didn't host production and the website on the same server. The attacker had access to the whole network. After that was detected and cleared, the attacker was still able to change DNS records. The domain was redirected to an attacker controlled site (https://github.com/matrixnotorg/matrixnotorg.github.io) where some logs of the production servers where posted.
https://i.4cdn.org/g/1555048975736.png
I have a hard time with the idea that they run the webserver and the matrix server on the same computer. (Regarding users.txt)
It seems they do urgently need to hire capable infrastructure people.