I was under the impression that there was a security hole in the password-reset functionality on Reddit, which allowed hackers to reset passwords of accounts without access to the email address.

The thing I can tell you is that the BCH wasn't stolen, the funds inside the tippr account was hacked (and not the central wallet), a bot was written to scan posts containing information about who got tipped - the users picked up by the bot had their funds stolen.