I am yet to receive any of these email notifications. Then again, I don't live in the US and hackers probably target those in 1st world countries first if they have the chance to sort out.
the problem is using the same Email address in many different places. i have seen so many people join a lot of these random website's newsletters with the same email, so it is obvious they are going to "sell" their list of emails! and then you get attempts like this and it is mostly a try to find someone who was dumb enough to use a password like "123"
i don't think it is cloudflare thing though, because it wasn't really serious and from what i have read it was just a tiny possibility to affect a tiny portion of sites.
p.s. i have not received any of these warnings about login attempts yet!
I am one of those guilty with using an email for registering to multiple service and sites. I just don't have the memory to remember a lot of passwords. I've had several emails in the past but end up forgetting the passwords as well as the security answer. I currently have two and this probably would be the most I can handle.
I've learned and don't subscribe to newsletters anymore. They just make a mess of my inbox and as you said, they might sell their mailing list.