My theory is (I work in this space): - Contact database was stolen - User database with emails+passwords was not

Basically it's about the emails that they were scraping / guessing, not their users' emails.