Phone numbers or email addresses that users submit when claiming keys via direct message may be collected and sold in bulk to third-party marketing or fraud groups.