This was briefly mentioned already but they could have got the information from scanning badges and/or buying a list from someone who was scanning badges.
When you fill out the form to get a badge all information that you give up is given to anyone that leases a badge scanner and pays for the information.
That would be why I have never put any information other than an email addy on there
