Google just let through an email spoofed from my own domain (via a mailgun server). It was a phishing attack about the domain being shut down. The connection between the domain name and my personal email address have never been published. Either google or Squarespace leaked the info.