Only if a bug in software on the website was exploited remotely via a script.  If someone obtained their username and password for FTP or the store admin, we wouldn’t know that a particular successful login to the site wasn’t from an authorized person. If they have Encryption turned on in the store admin, the only way the credit card numbers could be obtained via the website would be if that person had the Encryption passphrase, as the card numbers are stored encrypted in the raw store databases.

If there was a PC infected with a virus that was sending keystroke information to a third party, then that party could have also obtained the passphrase and the login information. They should make sure antivirus is up to date and do a full scan of any computers that access the account.