I have a masked email* for Instagram and have received two password reset requests in the last five days. Obviously, this is just an anecdote.

* https://support.1password.com/fastmail/

So what if you have masked emails...

Whoever it is, they just entered your Instagram username in the "To recover your password, enter your username, and we'll email you a reset link" field...