In reply to Agbonghama Collins.

I am just a man of average WP intellect, but I would guess they took a list from some sort of "10,000 most used passwords", ran it through their SALT, hashed it, and ran a database query to see if anyone is using that password? If so send the email?

Or something like that :\