I doubt that they were bruteforced, I would guess he created accounts with custom names like
multibox01@whateverdomain.xxx
and they got restored, and he thinks you hacked them/ that this program sends the data to your email, even tho the email domain is guessable.