The contact list of the person you emailed in 2017 was obtained by a spammer, who then sent you spam.

I don't have much to offer unfortunately, but I will say I've had an uptick on spam/unusual emails to my fastmail as well, including to some aliases. I'm wondering if there's not some way actors are searching out masked aliases, or are able to bruteforce combinations?

Just throwing shit at the wall however, no definitive proof one way or another.