Especially after their new list of banned accounts, I do believe something else has to be going on. I don't believe all these people got their information stolen from another game, there is just WAY to many. IF it is coming from another game, why don't they just 'hint' to us what game it is. If they have the gal to blame it on obviously another mmo, why have none of us heard about it??
So, either they are 1. just cracking the password through multiple attempts 2. obtaining it through SE database or 3. it's coming from a 3rd party site. Doesn't have to be a gil selling site, could be one you thought was(and looks) legit to find a guide through a dungeon or how to level faster.