The metadata in the breached records like "Imported from EverContacts" or similar supports the theory that it comes from a contacts app.
Looks like it was mined from somewhere and combined with other data...
Unless people are putting their github urls in the contact apps?
https://clearbit.com/attributes
That entire market needs to be killed off with hefty fines.