None of the existing answers cover the critical part of this question to my satisfaction: what about the salts?
If just the password hash values were posted, other crackers can't possibly know:
The actual per-password (supposedly random, per the source) salt value.
How the salt is mixed with the password in the code.
All they have is the final, resulting hash!
There are lots of ways the password and salt can be combined to form the hash:
sha256(pass + salt)
sha256(salt + pass)
sha256(sha256(pass) + sha256(salt))
sha256(pass + sha256(salt))
sha256(sha256(...(salt + pass + salt)...))
But if the salt is the recommended 8 characters of pure randomness …
sha256("monkey1" + "w&yu2P2@")
sha256("w&yu2P2@" + "monkey1")
… this means a "typical" 7 or 8 character password becomes extremely difficult to brute force, because it is effectively 15 or more characters! Furthermore, to crack password hashes that you know are salted, unless you also have the salt, you have no other choice except brute force!
Based on research I did using GPU cracking, I achieved 8213.6 M c/s using two high end ATI cards brute force cracking MD5 password hashes. In my benchmarking this meant I could try:
all 6 character password MD5s 47 seconds
all 7 character password MD5s 1 hour, 14 minutes
all 8 character password MD5s ~465 days
all 9 character password MD5s fuggedaboudit
Note that SHA-256 is 13% of the speed of MD5 on GPUs using Hashcat. So multiply these numbers by about 8 to see how much longer that would take.
If the salts were not known, that means you're essentially brute forcing the equivalent of 12+ character passwords. That is far beyond the realm of any known computational power.
Now if you want to argue that …
The original crackers also obtained the salts, but chose not to post them.
The original crackers also have the source code (or it's open source) so they know how the passwords are salted, but chose not to post that information.
Formspring is lying and their passwords were not salted or salted improperly such that the salts had no effect.
… then yes, cracking 200k of 400k password hashes in a few days is easily possible.