In Kim's case some of that information came from a blog, but it could just as easily have come from a MySpace page, a sibling's blog (speaking of their birthday, mom's name, etcetera) or from any number of places online.
Queue a check of all my information. I also found the information mining via inference rather clever. Maybe an attacker can't see your browsing history, but looking at your cache (specifically CSS files) gives just as good of information.
How I Stole Someone's Identity: Scientific American.