This would support the idea that they were phished rather than straight from the database. The phishing site may have just dumped all the submitted form values

This would support the idea that they were phished rather than straight from the database. The phishing site may have just dumped all the submitted form values to a file, regardless of whether a password was entered or not.