But how did they know your usernames?
There are 218,340,105,584,896 combinations in an 8-char alphanumeric PW. This isn't a large key space for offline attacks, but it's not something that's even possible in a couple of hours for remote.
8-Char Alphanumeric:
Time Required to Exhaustively...