I wouldn't doubt they are using stolen accounts. With the whole clickandbuy crap from years ago on ffxiv and other third party hosting of information... There's no way for SE to monitor all secure information. However that doesn't change the fact that stolen accounts are limited and usually require "reactivation" due to inactivity.