Knowing the previous phone number of the first sister, and having obtained a phone number that the first sister used before, there are three ways to steal the first sister's WeChat:

1. Scan the code with a device that has logged into this account

2. Ask a friend for help with verification

3. Verify the WeChat login password

I feel that the most likely way is 2, as long as the first sister's WeChat friend sends a verification code, it shows that there is a bad person in the first sister's friend list.