It turns out those that like the idea of giving your DNA to VC's then you are also highly likely to reuse your one true password (password123) on multiple sites.
lol, the other obvious explanation is that 23andMe is simply lying about the cause of the leak.
Lying about it would expose them to a lot of legal trouble. Im guessing they are choosing their words carefully as they have likely been worried about being sued from day one.