There was no leak. The API allowed you to see whether a given email had an account associated, so someone churned through a big list of known email addresses to find accounts.