So I dealt with something that seemed very similar while I was at Yahoo as a Local Paranoid (security person for a product). There was an enormously successful

So I dealt with something that seemed very similar while I was at Yahoo as a Local Paranoid (security person for a product). There was an enormously successful phishing attack that had rendered a crapton (more than 450k) users in a compromised state. Their passwords were basically stolen. The solution was a several month long effort by multiple engineers to get the proper owner to change/reset their password. Remember, their accounts are basically hijacked at this point and they don't even know. It was one of the most involved and complex issues I've ever worked on. Having gone through that I gained a lot of respect for Yahoo! and how they treat/handle these types of situations. Nowadays everything looks different so I don't know who's doing what. But the more I read and think about this my guess is that all those users were phished.