Discord claimed the compromised data came from a vendor used to verify users’ ages, but the vendor denied the breach.