As I read it, they got that information from her email, and were I a betting man I&#x27;d say probably Yahoo or Gmail. They already had her password; getting it from the website would be trivial. This is all my own assumption of course.<p>The underscore here is that a limited use case person, someone who occasionally posts limited things and doesn&#x27;t do anything beyond casual ebaying can still be a victim.