Most likely the users installed one of those free apps that ask for location access.
Those apps collected the location, even when not ruining and uploaded for sale.
It is a pity they did not do better forensics on the installed apps. One or more were revealing the location.