I don't imagine targeting any random user is particularly efficient, but when you are dealing with multi million user databases, finding close to a thousand people who share a first or last name probably isn't hard. They don't even have to address it to a person, simply provide some details (details vary based on database). Think "How was you recent trip to Hawaii? Click here for winter deals!"