This is mostly speculation, but I see a number of plausible scenarios:

* The article is correct, and NY Times did not salt their passwords;

* They salted them, but used a hashing algorithm [not slow enough][1];

* The attackers targeted a few specific passwords (either brute forcing them or building specific [rainbow tables][2] for each of them).

As for your last question, AFAIK the value of salting is to increase the amortized cost of breaking N passwords (i.e. without salting, breaking 1 password or all of them have the same cost; with salting, N passwords cost N times more than 1 password). A rainbow table *could* be created specifically to target a single account, but the cost of doing so is generally greater than just brute forcing it, so I doubt that's what happened. So I'm guessing you're right in your suspicion that "the reporter was confused about how the hack would likely have occurred".


  [1]: http://security.stackexchange.com/a/1164/6939
  [2]: http://security.stackexchange.com/q/379/6939