This is mostly speculation, but I see a number of plausible scenarios:

* The article is correct, and NY Times did not salt their passwords;

* They salted them, but used a hashing algorithm [not slow enough][1];

* The attackers targeted a few specific passwords (probably by guessing and/or brute forcing them).

As for your last question, AFAIK the value of salting is to increase the amortized cost of breaking N passwords (i.e. without salting, breaking 1 password or all of them have the same cost; with salting, N passwords cost N times more than 1 password). A [rainbow table][2] *could* be created specifically to target a single account, but the cost of doing so is always greater than just brute forcing it (see @ThomasPornin's comment), so I doubt that's what happened. So I'm guessing you're right in your suspicion that "the reporter was confused about how the hack would likely have occurred".


  [1]: http://security.stackexchange.com/a/1164/6939
  [2]: http://security.stackexchange.com/q/379/6939