I got an email from Yahoo yesterday saying I had sent a request to reset my password via secret question verification. The email was from yahoo, but maybe this is how they got the passwords. My account was still there at the time though.