More than one private key for RSA
This question can be summarized: the attacker found a $d$ that did not satisfy $e \cdot d \equiv 1 \pmod{ \phi(n) }$, but it works; what's going on.
It turns out that $e \cdot d \equiv 1 \pmod{ \phi(n) }$ is not necessary (it is sufficient).
The necessary and sufficient conditions are:
$$e \cdot d \equiv 1 \pmod{p-1}$$
$$e \cdot d \equiv 1 \pmod{q-1}$$
If both of these hold, then $d$ will always work [1]; conversely if $d$ always works, then both of these hold.
These two conditions can be summarized as a single relation:
$$e \cdot d \equiv 1 \pmod{\text{lcm}(p-1, q-1)}$$
This $\text{lcm}(p-1, q-1)$ modulus is known as the Carmichael function of $n$.
In the specific example you have, $\text{lcm}(p-1, q-1) = 60$, and we have $7 \cdot 43 \equiv 1 \pmod{60}$, and hence $d = 7$ works

[1]: Assuming $p, q$ are distinct primes.