That all it takes is for such info to be on a cloud system (Facebook, Twitter, any number of cloud sync systems) or for one of your contacts that you sent a CC email to to be infected. As well as the fact that EMAIL is not sent encrypted. Let's dwell on that for a moment.

Since EMAIL passes through many mail servers on its way to all of us, the email headers are in the clear for capture. With thousands of mail servers it is not much of a stretch to have some bad actors out there.

It gets worse the more you research. EMAIL today is based on a system from 1984 (strange that year?) and from a time when we didn't encrypt it all.

At the very least, your choice of antivirus should scan email in your email app.