I believe San Bernardino County was the owner of the iPhone so resetting the password would have gone through the standard process of sending a password reset request and then capturing the email at the server.

Apple may have assisted in providing the iCloud data in a more digestible form than what's available in the public web interface but that's more a matter of convenience than access.