They own the copyright to the code: they can do what they want with it. The licence is only a restriction on what people who don't own it can do.

Also, the GPLv3 is not the same thing as the AGPL. Even if they didn't own the code, if it was only GPL then they could make changes without making those available since they were not distributing the software (assuming this was just a webapp). The AGPL closes that loophole.