That's the thing, unless there's a huge gaping exploitable hole in the iOS, then these apps must've performed some sort of social engineering tricks to gain the users' iTunes Store passwords.

It's definitely a chink in Apple's armor, just wondering which part:
- iTunes Store itself (least likely)
- iOS sandbox (if this is the case, I'm surprised that the damage is limited to 1-2 perpetrator so far... and why there isn't an update yet to address it).
- iTunes Store' approval system (Maybe the guy hid the social engineering routing somehow ... and this sort of thing is nothing new for Apple )