It may be well possible that phished passwords ended up being used at Sci-Hub. I did not send any phishing emails to anyone myself. The exact source of the passwords was never personally important to me.