Twitter gave advertisers the phone numbers users had specified for two-factorauthentication, and advertisers used them to identify the users.