It looks like they got access to a list of names of existing users.