Oh this 100% is plausible, and even likely.

Many security questions systems use favorite food as a security question to reset passwords.

Most people use the same username for everything, often including their email address.

Take the person’s reddit or lemmy username, add Gmail, yahoo, Hotmail, etc. and with just a couple more answers pulled from social media posts you can build a fairly strong profile from seemingly very little and otherwise innocuous information.