Basically what they did was do password reset processes at a bunch of different services like PayPal, LastPass, Ebay.. yeadda yadda. He found that they all display different portions of a phone number. PayPal being the worst shows someone starting the reset process 5 digits. Most showed 2 or 3 but different portions.

So what he then did was essentially merge/correlate that data along with the area code and "exchange" (the part of number after area code) from sources like https://www.nationalnanpa.com/

Then he has a python script the queries (not sure how I didn't read the code, I'm assuming NOT through an API but who knows) the aforementioned services and somehow determines the likelihood of a number out of several hundreds being registered to an email or not. I kind of dozed off at the end so I can't explain that part very well.

edit: Why am I getting downvoted? This is literally what the blog is. My other comment is at the top.. lol. What a waste of my time giving an explanation. Ya'll like that low detail TechBrunch ChatGPT explanation more? Wild.

Martin Vigo's article discusses the security vulnerabilities in password reset options for various websites and how these can lead to the exposure of personal phone numbers. Vigo highlights that during a password reset process, websites often partially reveal the user's phone number. This partial display varies across websites; some show the last four digits, others the first, and so on. By initiating password resets across different sites, one can potentially piece together most of the digits of a phone number just from an email address.