I think it’s a lot likelier that some other company which has both your phone and email was breached, and conveniently the domain in your email tells them who you use as your email provider, which they can then pose as.