But then where did they get the list from? You probably have no idea where the emails originally came from and it's very likely the were collected/collated without the users consent. The agency probably got it from either some dodgy crypto site or ICO that required emails and sold them on or the hacked forum database or any of the other multiple bitcoin sites or exchanges that have been hacked or breached in the past.