[codingfounder]

As I noted in my post, I have already looked at the login activity list, and there's nothing other than my own IPs and sessions.

I have a similar domain via google apps setting that you have. I just don't understand how they got hold of my contacts, and don't know what I can do to prevent them from spamming my contacts again.

[axelfreeman]

Please check your pc. Is your OS, browser and browser-plugins up-to-date? Is there a browseraddon you haven't installed? Make a full virus scan.