I think what he/she did here is look at the test script.

in the test script, we can see thet the test is using the a list name logs to keep track of the user action.

so he/she just bypassed the whole code and inject what is needed into the list name logs.

What exactly did he do here?

I'd say easy or hard depends on using certain data structures to help with the task.