Well one guy had purchased account CD-Keys online from a gold site.
So that's one way for them to have your information.