Well as an ex flight attendant I can think of several different scenerios. One of which is that anyone with some knowledge how things operate in the air would know that usually the flight attendant in front galley will just ring the cockpit with a button located on the front communications panel, most often the pilots cockpit will then unlock the door w/o confirming it is the f/a (they are supposed to but they get lazy). I am sure that the f/a's
were up serving at the time that the plane turned back towards NY. The highjackers could gone up front rang the bell and gotten in before anyone could do anything.....or he might just had to deal with a f/a then ring the bell. If the highjackers didn't know how to get in the c/p then he has to take a flight attendant and threaten her and make her do what is necessary to let him in . If a highjacker is threatening me with a knife like that I would never ring the bell to let him in....forget it, and most any f/a wouldn't do that, training dictates this. If they c/p senses any trouble in back such as a hostage situation they will keep that door locked training dictates that.
I would guess if they didn't get on as a passenger, look to the catering trucks.