People being hacked since the last Server Check.

Alphabetical order, or by order of date and time of creation of the account
I believe every account ID has a hidden number associated with it, which is what Nexon actually uses in transactions. These would be assigned in sequence based on account creation date. Maybe the hackers basing attackes on those numbers.

Could be email address, too - the accounts were created in sequence in time, use a series of similar emails, and similar IDs.