[1812Overture]

They buy the info from massive data brokers, who buy data from other large and small data brokers, who buy the data from app makers, services, etc. [e-mail] expressed interest in buying kitty litter isn't exactly sensitive information so there's probably not much in the way of auditable logs maintained, probably impossible to determine the original provenance of the data in many cases.