From the Twitter replies: "the number was appended to local-part, not the domain. I found out by going back to a tab where my session was still valid but the account dropdown had updated with the new name. Profile settings revealed the email." https://twitter.com/bicycult/status/1255122953798328320

One possible way I can think of is they're hosting their own mail server and route messages for all unknown addresses to some mailbox (not that uncommon as far as I know - people do that to avoid bouncing mails with a typo in the address).

With such a setup it would be possible to notice that NYT mail started coming to foo1000@... instead of foo@... after requesting account deletion. Username change could also be evident directly from the mail, or it was a trivial guess.

Just have a friend working at NYT who tells you how NYT actually manages account deletions while having a pint; then try to delete your account and check whether the emails come to a new email. Write an article about it.