From the Twitter replies: "the number was appended to local-part, not the domain. I found out by going back to a tab where my session was still valid but the account dropdown had updated with the new name. Profile settings revealed the email." https://twitter.com/bicycult/status/1255122953798328320

One possible way I can think of is they're hosting their own mail server and route messages for all unknown addresses to some mailbox (not that uncommon as far as I know - people do that to avoid bouncing mails with a typo in the address).

With such a setup it would be possible to notice that NYT mail started coming to foo1000@... instead of foo@... after requesting account deletion. Username change could also be evident directly from the mail, or it was a trivial guess.

He’s saying they append 1000 to the user and domain.

/edit I was wrong. It’s the user and email. Your theory would work

>/edit I was wrong. It’s the user and email. Your theory would work

Why? My interpretation of "append 1000 to email" is that 1000 gets added to the very end, not the local part.

Just have a friend working at NYT who tells you how NYT actually manages account deletions while having a pint; then try to delete your account and check whether the emails come to a new email. Write an article about it.