[ptwiggens]

I highly doubt the hackers plan was to get email addresses and try to brute force from there... just doesn't make sense.

If you search Google, people are all the time receiving password reset emails going back years, even repeated ones.

Email addresses are in the clear all the time, and I've never heard of them being considered sensitive before. You should assume everyone has your email address.