Same here, I had three e-mails listed: my personal email I used for Facebook, my @facebook.com email, and a work e-mail that I don't appear to have listed in my profile or settings anywhere and don't recall even giving to Facebook.

Perhaps the "merged" contact information that got leaked included e-mails for you that your acquaintance had that you perhaps never told Facebook about?

EDIT: that would seem to be supported by this line:

"This contact information was provided by other people on Facebook and was not necessarily accurate, but was inadvertently included with the contacts of the person using the DYI tool."