Did they not post the entire load (and are in fact sitting on _all_ the hashes?) Is the dump an old backup or breach from when they had fewer accounts? Is it just one DB partition / file that's been lost, an archive?
sort -u combo_not.txt | wc -l 6458020
wc -l combo_not.txt 6458020
• Someone got in to one user database, but not all of them.
• Someone got into the complete user database, but were found out during the intrusion and cut off.
• Someone found a sharded DB dump or backup.
• Someone found/stole/virus'd a dev laptop with DB dumps.
• Someone sat on the network for a while and grabbed app server -> DB traffic.
Replace "Someone" with "russians," "brazilians," or "something behind tor" for more accurate portrayals.