I'm not surprised
I DAILY get several emails like "your account was signed into by an iPhone in Angola. If this was you, you're all set. Otherwise, click the link below to go to our 'Resolution Center'." And other similar crap. Given how many folks just can't get the idea of how phishing works, I wouldn't be surprised by any number of pawned accounts they have available for sale.