I don't think criminals are stupid; they're simply lazy. They put the minimum amount of effort is into a scam like this in order to make it profitable.
An off the shelf key logger is used; a couple of stolen email accounts, and a spammer is used for delivery. There are automated tools that will pack the key logger executable in a word document also.
As for the part of the security researcher; reversing .net code isn't challenging. This is by design - the framework does not obfuscate or make it challenging to look at the code. The author of the key logger could have built in protections or obfuscated his executable but for one reason or another has not.
Most likely all of the reversing or analysis was also done with automated tools, and the analyst simply had to run them. OfficeMalScanner can be used to locate packed executables in MS documents and extract them, and then it is simply a matter of dumping the binary in the .NET decompiler of your choice (the author uses ILSpy, I personally prefer RedGate Reflector) and looking at the code.
IMO this is a marketing piece that happens to have an interesting story attached to it.