Sibling comment explains the idea, but I also think a lot of articles about this tend to present the theory of someone positioned between the two sites overriding the microwave signal as more definite than it is. It is perhaps the most likely explanation, but no real evidence was ever found to support it, and I think the possibility of another means (such as an insider, as in other prominent incidents) still exists. It's tricky to know much about this incident with much confidence, because it's been rehashed so many times by so many writers and ultimately the original sources tend to be contemporaneous newspapers quoting unnamed FCC sources, the FCC never published the findings of their investigation. The specific fact that the FCC concluded it was done by overriding the STL link is very hard to source but has been repeated for a long time, perhaps later I will spend more time in the newspaper archives to see if I can figure out where it first came from. I would guess "someone from the FCC said."
The antennae used to receive this kind of "STL" (studio-transmitter link) are directional, like horns or parabolic, and tend to be very directional both by design and due to practical considerations around microwave frequencies. But the TX power used on STL links is actually not very high at all, 0.5W is reasonably common for mid-range microwave links (up to ~30 miles) but in the city it may have been at more like 10W due to high noise floor. That said in 1987 microwave power electronics were not as advanced as they are today and more than being large (picture like a 4U rackmount unit and pretty heavy) they were very expensive. I don't think it's at all crazy that someone got the equipment in place, but it probably would have been someone in the broadcast industry or who spent a pretty good amount of time finding a deal on used equipment, just to have access to a suitable transmitter.
But in general, directional antennas are not magic and have substantial imperfections. Their receive pattern consists of "lobes" in directions in which they are sensitive. A typical microwave antenna will have a very substantial front lobe, smaller lobes in off-axis directions that are just an undesirable effect that's hard to eliminate, and near zero sensitivity outside of those lobes. That strongly suggests that the person originating the signal was on-axis with the receive antenna because if they weren't the transmit power required would become far higher, probably out of the range of the equipment that was used in the broadcast industry at the time. "On-axis" in this case would depend on the specific antenna but could be as wide as maybe 30 degrees and as small as a few degrees. Bigger antennas tend to have a narrower beam width and smaller off-axis lobes, but STL links usually smaller antennas because they don't need a huge range. I'd wager 15 degrees, horizontal and vertical, as a best guess, with side lobes that are probably not usable. Parabolic antennas as a rule of thumb tend to have almost no "back lobe" (which is the most common off-axis sensitive area for other antenna types like log periodic) but a bit of a "side lobe" at about 90 degrees each way. A common spec sheet metric for parabolic antennas is "front to back ratio" and it's usually like 30dB or more, the reflector is really good at blocking anything from behind. So if you want to get a little wilder it is somewhat possible that the transmitter was perpendicular to the beam if they were very close, but hard to believe that it was behind.
There's no real reason for the attacker to be within LOS from the transmit antenna, other than that given downtown Chicago most places that were in beam for the RX antenna would be in beam of both. The attacker could have been behind the transmitter but that would have made the power level required much higher, to get the receiver to lock onto their carrier. And even today, typical STL transmitters aren't really sold over a very wide range of power levels, so it's not very practical to just get a transmitter that's say 10x more powerful than the "legitimate" one.
The point of this long ramble is that "on a roof top close to the vector between the two antennas" is a most likely guess but not the only possibility. It's not clear that the investigation ever even clearly established that someone hadn't broken into (or had access to) the transmitter site. I'm sure they tried to run that possibility down but I can't find any conclusion. There are reasons to believe that it was a signal override based on the transmission, but that would have been a lot easier if the attacker was just on the roof with the RX antenna.