Lo and behold, there was a data breach of employee and volunteer records. Volunteers had to have background checks, which required the SSN. Thousands of people had their IRS return hijacked due to this breach. I personally know dozens of people who were impacted.
From what I've seen of their information security, I remain completely unsurprised that they had this breach and that to this date they have no idea how it happened.