[tuga]

I'm just speculating, but it's possible that one of the services you utilized with your catch-all account attempted to check if the same password was used for other services. Alternatively, the VPS network might be inadequately configured, enabling tools like tcpdump or Wireshark to intercept network traffic.

[2b]

Interesting points, thank you. Both seem quite possible.