The password reset email could be requested with an email and attackers use leaked emails from lists recorded in for example haveibeenpwned.

Sadly in the Alby case the password reset email could also be requested with the lightning address which is likely what happened to you. Some attacker got the lightning address from nostr for example to do this.

We have disabled this now.