The criminals are using old databases of old hacks of some sites. Since most people use the same 1 or 2 passwords for everything, and never change their password, a password used 10 years ago may be the one used in the letter.