Yeah it's a worry. I checked if my email address had been pawned on the haveibeenpwned website & it had been. No wonder I get so much persistent spam. I've since changed passwords and switched on 2-factor authentication, but once they have your initial credentials, the spammers are a like a tick dug in deep under the skin (ie: a b**** to get rid of).