The runaway OpenAI models that hacked Hugging Face also breached a customer at a second tech company during a week-long spree