You can't treat each day as an independent random event: if a user has a weak password (e.g. "password1") then they may be compromised multiple times in a year.
Sure, but also have less than 1 billion active accounts. Anyway, I am more reacting to "this is the best way you can make these number look?" vs. some real estimate of the number of compromised accounts.