Saw this great comic that explains it in simple terms. Notice the last request is for 500 letters instead of the expected 3 for hat. (the stick figure is the hacker.)