Sold Gamertag #/stolen - How did they get my email address?

I had a hacker get into my Microsoft account and change my Gamertag so that they could buy it on a dummy account (presumably to resell or use themselves later on). Note, they also got access to my email account, which is what allowed them to get access to my Microsoft account. My question is, how did they know the email associated with the gamertag to begin with? Without knowing the email address of the Gamertag, they wouldn't have known what email to #, so they must have somehow found out the email address for the Gamertag first.

# #/scataloth
. .