One of the companies you interacted with likely sold the data to them OR a browser plugin scraped the data from an email you sent to one of your contacts.