"They chose email providers with little to no protection against automated account creation." To be specific, go2.pl, o2.pl, prokonto.pl and tlen.pl are the ex

"They chose email providers with little to no protection against automated account creation." To be specific, go2.pl, o2.pl, prokonto.pl and tlen.pl are the exact same mail provider - in fact, those domains are aliases for each other after registering. This means that by registering a single time, they get four usable e-mail addresses. Interestingly, the same provider also provides a functionality to get more aliases if you want, but it doesn't seem like criminals used this functionality (the aliases cannot be in those four domains, rather they can be in another list of 18 domains).