I made the following edit to the OP: "As is always the danger when data is retained, the data was leaked when the list of addresses was sent in clear text over tormail (edit: the addresses were sent with weak encryption, not in the clear)."