Where did Verisign get their data from?

The New York Times is running a piece on the investigation. Not much more information than what Reuters presents with the exception of some background information and a quote from Michael Palage in which he asks "[H]ow did they get the data [for their mass marketing campaigns]?"

My guess is that it has something to do with this clause in their accreditation agreement.

The Register is running a similarly thin story...