As I noted in my post, I have already looked at the login activity list, and there's nothing other than my own IPs and sessions.

I have a similar domain via google apps setting that you have. I just don't understand how they got hold of my contacts, and don't know what I can do to prevent them from spamming my contacts again.