Even if you paid by credit card, there's zero chance they processed the payment themselves.

HaveIbeenpwnd says it was just passwords/usernames/emails, so seemingly not. (My company just got an email from them about the breach and I confirmed I'm in there with a quick search on their website.)

That's what Troy got sent. It's not necessarily all the attacker took.

Good point and thank you for the reminder. Time to go check my email archives...

they use Stripe

If you're a blackhat and you want to be annoying, you can use Stripe tokens to charge your target's customers. The target is the payee, so you won't make any money, but it'll add to the chaos.

If Stripe hasn't already, it won't be long until they revoke all of IA's tokens in the event they start using them.

If they stored your email from your donation the IA would have already used it to spam you themselves, no attackers needed.