>>11258085 (/pb)

My guess is they had his Mac hacked for quite some time and were easily able to record him whenever they wanted