Its more likely that you published your mail address somewhere else.
Not likely. I have different email addresses for every website I go to, I do not reuse them. Would I post it I would have used a different one for exactly that reason. It lets me track where I am getting emails from, its a thing I have done for years.
That however is not the larger point. This person is targeting bitcoin related people it seems since the analysis that I posted included someone else that appears to have a bitcoin affiliation getting the same jar file. Regardless of where he got the email from he is targeting bitcoin people presumably for the purposes of violating wallets which is bad for the community.
edit: to be clear the "analysis that I posted" refers to the url which has analysis done by someone else. I just reread this and it could be interpreted that I was trying to take credit for someone elses work. That was not my intent.