[grepfru_it]

But hold on.

They could have git cloned your repo, used or otherwise analyzed your code which follows TOS then used the local git repo to pull your email address.

How is GitHub responsible here?

[influx]

They could have, but it seems unlikely they targeted one or two repos and probably cloned thousands or more.