I don't use rcon password. That person set a password to himself...
He asked 3 times for players list(amx_who), he did something and he get acces for servers rcon, then set a rcon pass.
I see somewher this method for hack server's rcon pass but i don't know where.
He said something about ddos flood method.