The tweet doesn't say that these photos came from "Photos", just an "unused account". All other evidence seems to suggest that these are photos from another service called Panoramio which Google acquired at some point. Not saying it's right or wrong by the way (perhaps something in Panoramio's TOS that all photos were public), but based on this news I'd assume that my beach photos in Google Photos are safe from prying eyes - for now.
Strange... Among all of my google accounts I have checked and NOTHING was automagically shared. My pictures must suck or I did NOT do:
Share a photo
On your computer, open Google Maps.
In the top left, click Menu Menu and then Your contributions.
Choose Photos.
Find the photo you’d like to share.
In the top right, click More More and then Share.
Picture is from 2011 and was originally hosted on Picasa (but I'm pretty certain it was never shared publicly) and I don't have a Google Plus account. If I go to the picture itself on Photos, there's no sharing/privacy controls, so I'd assume it is private.
The wording on the email makes it even worse, as if I had intentionally done something overnight to share them on Maps.
I can't find any evidence that it has been. I use a long and strong password and have 2-step-verification enabled in my account. I haven't received any new account activity emails and the I don't see anything suspicious on myaccount.google.com
As far as I remember, I've never used Panoramio (as a comment above suggests to be the cause). I'd agree that this seems limited to some specific circumstances.