Possibly a password leak from another site resulting in a targeted large-scale account access to download customer data from a leaky API? (Baseless commentary.)
Then if people do that, wonder if they also try to signup people? That would explain things maybe... Like some sites don't verify emails for signups, had someone sign me up for Spotify on an email of mine, when I don't have an account using that email. Never verified the email but got login notification emails... I reset the password and deleted the account.
Then I get emails saying they are from Anna at Netflix wants to chat with me "If you’d like to chat before you start your subscription"... Idk if they like typed in my email and never finished signing up or what but creepy... I have heard some sites log uncompleted signups even if you never clicked submit.
Kinda makes me wonder if these people selling breach data sets would sign people up too then if it's a email someone used elsewhere, to bulk up the numbers of users in their so called breach by adding newly created accounts, along with valid email/passwords harvested from other breaches. Then probably an inflated number would make their dataset be worth more money to people trading the datasets on the dark web I'd guess.