Just got this as well. I changed my password on GitHub about a month ago, and it looks like only those who changed a password were affected.

If I have to guess, they maybe saved the plaintext from the form when testing the password reset feature for some reason?