Once you limit it to accounts actually worth hacking which don't have an authenticator you're probably looking at more like a million accounts.