It would seem that the @twitter website has endpoints for fetching people who have favourited and retweeted a tweet — again out-doing their API. Example:

https://twitter.com/i/activity/favorited_popup?id=353546206921756675