Strangely, I use a unique email for github, like I do with most sites that allow attaching "+comment" to the localpart of email addresses. Are attackers really

Strangely, I use a unique email for github, like I do with most sites that allow attaching "+comment" to the localpart of email addresses. Are attackers really this sophisticated, or where did they get the list? Edit: Nevermind, I guess github allows authenticating with a username, in addition to the email.