Bitstamp's email list was confirmed stolen ~2 weeks ago, when a boatload of emails claiming to be from
support@btcguild.com (but not sent from any of the BTC Guild mail servers) went out talking about a 3.201 bitcoin transfer. After replying to the people shouting at me for being a scammer, I was eventually able to narrow the source of the leak to Bitstamp at the very least, and likely a few other sources on top of it.
I informed Bitstamp that they had at least a breach on their email list, if not the rest of their system. At first they denied it, but in a follow up they eventually admitted to it.
They then sent out a little security update email mentioning 2FA/password security.