The methods to scrape numbers from social media have been published on YouTube for ages now. They share those numbers publicly because they themselves run services that share user data with other companies openly... Twitter (for example) is used as an authentication service with Disqus and a few other online apps too, an online comment service which could easily save/track sensitive ID data across comments on multiple sites unwittingly to the user, so it's a really shady overreach if that is indeed the case. These numbers are gathered under the guise of security, but they are used for entirely different purposes.

I think the real fault is in them forcing users to enter this type of data to begin with, because that makes the only options to surrender your data to them or to not use the app at all.

It would be interesting to see if numbers from verified accounts were included in the leak, that would be very telling.