You will probably be amazed at the number of web sites and phone apps that have had access to your contact list - just to get something done. Easy to forget when and when.

Could even be that it was someone you know who has your email address who gave their contact list to this spammer (directly or indirectly). The bad guys could then have simply picked one email address as the from and got to it spamming the rest.