Spammers might have found your phone number through public records, data breaches, or data brokers who scrape the web and public records and sell the information they find.