Am I missing something? The source they shared is a screenshot of a password reset email, which anyone can trigger if they have the email address of the account.
Whoever it is, they just entered your Instagram username in the "To recover your password, enter your username, and we'll email you a reset link" field...