Possible Nexon Database Exploit?

My friends that were hacked reacently had their e-mail pw the same as their old maple story pw. That list (that nexon denies existance of) is still out and hackers are now trying the passwords on e-mails. If it works then they just reset maple story pw & pin and strip the account. The good hackers then delete the e-mails for the pw reset (burn the evidence) and only take anything really valuable. Then they see if the person didn't notice and try the same stunt a couple weeks later. My friend told me, "I wasn't hacked there were only a couple items missing and I had that PIC glitch." I told him there was no PIC glitch, he was hacked and to go change his e-mail pw and ms pw. After that no more trouble. But hacker was changing his MS pic every few days before he changed his e-mail pw.