If you have signed up on dubious websites with questionable privacy policy, many of them legally sell this data to “data brokers” who then sell it to anyone willing to pay. This happens more than you’d think, for example in 2019 it was reported California DMV makes $50 million a year selling users information. https://www.caranddriver.com/features/a32035408/dmv-selling-driver-data/
One neat trick is to signup for services with an email like [email protected], that way if you ever get spam you’ll know where you have been compromised.
👏🏼👏🏼