I can confirm they either sold their database or it was compromised.

I signed up for 6 accounts with ROM 2 years ago. I created 5 new emails on my domain name as they have to be unique per account. These emails were never used for anything else.

Last week I logged back into them to reset passwords and each of them had over 500 phishing emails in them.