Yes, it's POSSIBLE, but more PROBABLE it's someone on the inside, let's say an admin, sharing this data.

Remember to never use the same password on websites as your email address.