My public wallet has, the frozen wallet hasn't so I think it's a service I use selling active addresses to these people....
Question is which one....I've used almost everything lol (most recently being Dell)
They are getting addresses from recent transactions on the blockchain, any node has that data.
I think they are actually getting the addresses from posts on this forum. There is another thread where someone posts 1,600 BTC addresses and all but one of them received a TX from laxo trade within 30 minutes.