I recently changed an admin user email on a WordPress site that I manage. I used the same email address for the settings field within WP Admin. The new email address is completely unique and is not used anywhere else online.
Several hours after the changes were made, I received a series of spam emails.
How is this email being leaked and how can I lock it down?