Selling email list. Most likely he has hacked from any others database....
All the data offered is the kind of info people would usually submit in the bounty campaign threads. I can't think of any other place people would submit their social media names along with ETH addresses. Email addresses are bit unusual, but I've seen a few bounty threads asking for such, and they had hundreds of replies. And he could also just copy/paste details from campaigns' spreadsheets.
38k users seems a lot, but I won't be surprised if the number of "bounty hunters" was way higher than that.
If I'm right, such data is not worth too much, as it consists mostly of 3rd worlders looking to earn a buck, not to spend it. So hardly 'potential ICO investors'.
And as far as I know the email is considered to be part of the PIM.
Correct. It doesn't change even if such information was voluntarily submitted on public forum.