There’s really nothing to be done about the compromised email address, but I would really recommend using a service that creates unique email addresses per service that you sign up for to mitigate the blast radius when one service gets pwned. It takes a long while, but thankfully privacy laws are stronger now and it’s easier to force a company to either delete your information or change the email they have for you.

Some potential services to consider include:

https://addy.io/

https://proton.me/pass/aliases

https://www.fastmail.com/features/masked-email/

https://support.apple.com/guide/icloud/what-you-can-do-with-icloud-and-hide-my-email-mme38e1602db/icloud

Spam email has always been a problem, and there is really no way to find out how they got your email address and no way to prevent it either. Email lists are bought, sold and traded all the time.

What I do is keep the email client Thunderbird running on my desktop. It has a really good smart spam filter that learns from the email you receive and what you mark as spam/not spam. With IMAP, even your mobile devices benefit from the filtering.

Every few days I’ll check the junk folder and mark “not spam” anything that it incorrectly flagged as spam and go through my inbox and mark spam on anything it missed. I think it miss-flags maybe 3 or 4 emails per week right now. Doesn’t happen often.

I gave up on this years ago.

Figuring out how they got hold of your email won't be very satisfying. It's not possible, but if it were you would find it's some obscure forum you signed up for 10 years ago to make the search function work, which hasn't updated their forum software during that 10 years, and is now leaking email addresses.

Point is, the horse has already bolted and now your email address is on the lists that get sold on the dark net. There's no going back.

My understanding with spam / phishing is that most email providers will identify and remove 95% of it. gmail will catch 99.9% just because of the volume of emails going through their servers. I personally would pry my eyes out with a fork before using gmail so I'm stuck receiving 5% of spam. It's nothing really. Every day (or several days) I look at my inbox, action and archive as appropriate, and delete the rest. It literally takes less than 1 second because I would have to "delete the rest" anyway.

As others have mentioned, "catch-all" email addresses are one method to kind of mitigate or manage the problem, but ultimately I've found it to be a cool trick but ultimately inconvenient and maybe pointless.

https://haveibeenpwned.com/

You can check this site for specific/recent breaches. That said, your email may have been exposed in an older breach that's just now getting spammed as well.

This is what I did years ago. It works great for me.

Got my own domain.

When I'm forced to register somewhere I use <their site+how much I hate them>@mydomain.com

So, when EA forced me to register an account on origin, it was fuckea2011@mydomain.com.

If I see an email address start to get phishing and spam, I disable it.

Happened to me a while back. In my case, they had also gotten access to my google password manager and were trying to cover their tracks in funneling money from my bank account and purchasing phones on several platforms (google store, eBay, etc).

Absolutely change your banking passwords, let them know that there could be potential fraud, and start looking for purchases on every platform you might have saved financial information on.

Best of luck.

I've found that 99.99% of my spam comes from emails with weird extensions - .xyz, .world, .shop, .best, etc. - so I've gotten a significant amount of relief in getting a mail client that lets me block entire domain extensions (BlueMail mobile).

Did you get a huge flood of emails at the start? That happened to me one time and it was because one of my old passwords got leaked. Buried within the flood of emails was a legit "your password has been changed" email for an account.

A good email provider is your best bet. I've been on fastmail for years and they rarely let spam through despite me not protecing my address

Make a new email, and use email aliasing (AnonAddy, Simplelogin) from now on. They can't get a hold of an email that no one has.

I've been dealing with my e-mail having been involved in multiple beaches and have been spending a couple years trying to migrate my accounts to aliases that go to a new e-mail address. It's a long process to say the least. 🫠