"This person" used basic methods to find DLL entry point (observing DisableThreadLibraryCalls function which is called in the DllMain, not always but very often). Then he took step by step analysis of the code the dll executes, and everything was clear at that point
Edit: Well but thats a rocket science ( i dont know, i just think that its hard looking at this person do it)