Compromised old password

OK, I got an interesting email today on one of my cc email accounts.

It was ransomware saying they had my account password, and give them money, etc.

My cc account password was not compromised, and I have just changed my password as an additional safeguard.   (Curious why you have a limit of 16 characters for passwords)

What worries me is the password they included in their email as my password was a VALID Comcast account password that I had used in the past.   I'm darned curious how they would/could know what a former password was.  Have there been any CC data compromises or any other way they might have my old password?

(And do you (CC) want a copy of this email for your records?

thanks

- John Mc