ADP has for years, and still does, allow bookkeepers, accountants, and HR services firms similar to Zenefits to access client accounts via 3rd-party administrative logins that clients themselves set up in their payroll.
The way this works is that you, as an ADP client, call them up and says "hey, I've asked my HR firm, XYZ-HR, to manage my payroll. Can you create an account for them to access my payroll system?" ADP creates this account, and XYZ-HR then handles all the payroll admin work going forward -- adding employee, terming them, inputting hours worked, managing deductions, etc.
This is how this has worked for years, and it's how thousands of companies do this via ADP. Even today, as an ADP RUN client, you can call in and add any third-party person you want as an admin to your payroll system -- as long as it's not Zenefits. ADP has marketing materials that describe this feature, both for companies and HR / bookkeeping / accounting firms. This is how Zenefits was accessing client's payroll, and doing so in order to take on all the administrative work related to payroll that you don't want to handle. We weren't "hacking" anything. We were doing this at our customers' request, with their full knowledge of what we were doing, and ADP set up these accounts with @zenefits.com email addresses, knowing it was Zenefits.
There is nothing improper about how we were doing this.