Third parties don’t know his email address per say. A third party has hold of the OP’s info through a different source. This information in the third party DB i

Third parties don’t know his email address per say. A third party has hold of the OP’s info through a different source. This information in the third party DB is linked to a cookie or device id, or other means of digital footprint. Facebook onboards the third party data by syncing the ID they have for the OP under their origin, with the ID from the third party’s origin through a process called cookie syncing, which allows data from one origin to be pushed to another. Cookie syncing is how it is done on the web. For mobile, it is device ID syncing. To sync multiple devices, web + mobile, you use IP affinity + geo, or other means of inference and find common patterns through the stream of data. It is easy to link devices having access to the ad stream of an exchange like AT&T’s APPNEXUS for example. These are practices that were standard five or so years ago.