Ah yes, I found it. Sorry, I slept in today.
If the safe lookes like this one:
Then it probably responded to the default password of all-zeros.
There was a write up about this safe not long ago.
Even if hotel staff put in a custom default password it's possible she happened to be arround one one day when they were opening a safe for the guest.
I've opened this safe at a couple of hotels just using the all-zeroes failsafe.
This is the most likely explanation. Francois doesn't look like much of a hacker.
If I was in her position (and the all-zeroes didn't work) there are still ways of getting in.
Could apply a thin coat of hairspray to the keypad before a guest checked in then inspect it after they leave to get the keys they used. For a 6 didgit combination this would only help you narrow down possible combinations.
Mount a security camera facing the keypad. would have to get a really tiny and expensive camera but who shields their code when in their own hotel room.
Pull off the plastic facia on the safe and access the firmware programming connector. Dump a new firmware onto the chip using high-voltage flash programming (it overrides built in data protection on the chip).
I haven't seen this safe but on a few models the leads to the actual motor that withdraws the lock can be accessed even if the safe is locked.
When the safe is open, the mounting hardware can be accessed, uninstall the hotel safe and re-install one just like it that you purchased yourself. Now you have the default code and can open it whenever you like.
I'm pretty sure this case involved one of the first two possibilities.
I let my housekeeper know first day that every area of my room is under surveilance. I get a text and a picture whenever anyone goes into my room during the day.