If it's any help, two came to my (iHub) "private" e-mail address, none to my (iHub) "public" e-mail address.
(I'd like to plug FIREFOX for it's outstanding handling of this trash).
I have, from time to time, sent e-mails to Matt when I was unable to log in to iHub. Those messages had my "private" e-mail address and are (probably) stored separately from the iHub member data. Could that be the source that was tapped?