You might be making quite the assumption that those account credentials were phished, rather than voluntarily donated to Scihub. Support for the project is pretty wide (probably well above 50% of academics), so I'd expect credentials from almost every university to be donated to them.