I've recently received two spam messages that show a possibly worrying degree of knowledge about my contacts, and I'm wondering how concerned I should be.
Specifically, the names -- but not the email addresses -- that they appear to come from are family members. They share the same last name as me, but it doesn't appear to be random name guessing -- the only two messages I've received with a sender sharing my last name are real first names of family members (no "misses"). Edit: one of the names is fairly common; the other is pretty rare (didn't rank higher than #428 on http://www.ssa.gov/oact/babynames/), and can be easily discovered by visiting the website linked in my profile.
The messages were addressed to an older email account that I no longer use, but that's still set up to forward to my current address. This older email address does show up in various google searches alongside my name, but neither of these other two names as far as I can tell.
Given the above, how concerned should I be that my account has been breached -- as opposed to an account belonging to some third party who knows both me and these two family members, and still has my old address in their contact list?
Edit 2: I've had 2-factor authentication enabled on my main email (gmail) for some time before this spam began arriving, with no known loss of control of my phone, backup codes, etc. I will also enable it for Facebook now that that's become available.