Well, if all we have to go by is this email; it's rather hard to make judgments about what Github did or didn't do.

I'd hope that github will do a post-mortem, and tell us what they know of the breaches.