I'm guessing they were hacked, presumably through shared passwords leaking in other places (which is why you are advised to not use the same password for every website). Those accounts had actual human activity before so unless they were brainwashed by the crypto virus that's the only explanation I can think of that makes sense.