Twitter gave advertisers the phone numbers users had specified for two-factor authentication, and advertisers used them to identify the users.