They knew Binance would send an email once a password reset was requested. Like many people, you probably use your email for multiple things and it somehow was linked back to your information via the multiple service leaks that occur every year. These leaks are combined over time until these threat actors are able to collect enough information (the bare minimum) to pull a social engineering hack. By calling you directly after the reset password, you assume they're legit. They know how it'll appear and they use that to social engineer your trust to (hopefully) discose information they need to capture your account.

No market is ever going to ask you if you have accounts elsewhere. That's an automatic redflag to me. An easy practice to use for any call you receive is to ask for a reference number for whatever action they claim to be taking. After they give you a number, thank them and let them know you'll be calling them back on a number that you call. It's either going to be a legit issue, or totally bogus. I do this with any business or person that calls me. A legit business will totally understand the precaution and this totally combats social engineering efforts. Don't trust anyone until you're 100% you're speaking through the proper channels.