It's a brand-new spongebob-themed account with a smug "hello" tweet, being retweeted by one of your groyper friends.
Nick's previous hundred alts have been brand-new spongebob-themed account with a smug "hello" tweet, being retweeted by one of your groyper friends.
That's why they thought it was him.
This is the first time that pattern's been effectively exploited (assuming it's not Nick), so that's why they didn't take precautions before following. Remember, he gets banned every week. It's all very well telling people to check the instagram to make sure it's Nick Approved, but at some point most of his followers will get sick of doing that shit so frequently and will slack off. And once it's fooled enough other people, everyone who sees subsequent retweets will be less cautious.
If security precautions are too much of a hassle, they end up failing: an employee who has to use a hard-to-remember password will have it on a post-it-note on their desk. In this case, he's getting banned so often people will just refollow a Nick-like account without going through the verification bit.