How emailsherlock.com gets its info?

I recently registered an domain with obfuscated contact info (except for my name) at Gandi. Then proceeded to create a email account (also using Gandi's email pack) which I used to create an account at Golden Frog VPN service. I also used it to create an account at metafilter.com and stopped there for lack of time.

Today, just a few days after the domain registration, I received a standard phishing scam email. It's interested that I have only used this email at Gandi, Golden Frog and MetaFilter and somehow emailsherlock.com knows about it and I received a phishing scam. Even Google does not have any hits on that email address except for the emailsherlock.com XML file.

I feel I can't trust Gandi/GoldenFrog/Metafilter OR they have been hacked. Any ideas?