This seems possible. People usually use the same email and password for every accounts they create so all the hacker needs to do is to try the username and password on accounts on other sites.