Assuming the source of the credentials (malware, other breaches, etc) is correct, 320k isn't outlandish by any means.

My Twitter bot, @dumpmon, comes across thousands of leaked creds per day, and that's only on pastebin.

This, combined with "checker" services that can verify credentials to services like TWC make things like leaked credentials be correlated into "from these x unique dumps, we have a group of creds that all work with TWC as well".

My guess is that TWC was alerted to a file someone was trying to sell that took leaks from other public/private dumps or malware infections, checked them against TWC, and verified that they all happened to work. This would be why TWC wouldn't be able to pin down an exact source - there absolutely doesn't have to be just one source.

It happens more than you think.