Also remember all the user-account leaks. If you were part of the leak then it is trivial for bad actors to craft the perfect email, when they know what sites you have accounts on.