As I've pointed out before, all anyone would need to know is that the domain existed before they hacked it. I.e. an email address would do it. Once you have an email address, you ping the domain name to see if the computer is up. Once you know it is up, you can start probing it for vulnerabilities. Now, if that was "Gmail.com" or something, you likely wouldn't get very far. But an unsecured box like clintonemail.com would have been trivial to hack.
