Just to add in the technical realm. It could also be a security vuln, a very common one through which the attackers get massive amounts of emails and that'd be shared with tens of thousands of other websites. Like, auto-harvesting through a vuln.
In any case no selling or leaking, that would just not work.