A port being open doesn't tell you that it was open to being hacked.

The truth is that there is no way to tell the access vector right now. You can't trust any artifacts left on disk on the machine. The only way to tell would be a full packet capture on a device positioned in front of the server. Even then, if the exploit came after an encrypted session was established, you won't see what it was exactly... just that something funny happened on the box after that particular session. As I understand it from the few articles I've seen and Comey's testimony, they didn't have any security in place... so certainly no pcaps.

Remember that malware has been reused in the past (look at how many different groups used plugx or PoisonIvy). Infrastructure can be acquired anywhere in the world.

Be extremely skeptical/cautious when reading someone's conclusion.

Do I think it was hacked? 99.9% sure it was. The problem is they couldn't prove it because they lacked the logging capabilities... which I'm wondering how isn't a crime in itself. But hey, I'm a tech guy, not a law guy. ¯_(ツ)_/¯