My belief is that the hackers might get the username password combos, but they grouped the hashes to only have unique (sort -u ?) passwords hashes and therefore ease the process of dictionary cracking them as they do not have salts. The 00000 prefix might be an indication of this. I bet there is an automate script taking care of a dict attack and the file was released during execution.