Someone contacted me by email but my email is not public

Here's one way they could have done it.

I was able to link you to a GitHub account based on a Dropbox link you posted (with a quick Google to make the connection). From there, I cloned your repository and your email address was visible in the raw Git commit data.

I also found a MozillaZine account, but I couldn't find any Chromium bug tracker connections.

To respect your privacy, I won't be any more specific (unless you ask otherwise).

Someone really wanted to talk to you (or maybe they found an easier way).

The situation mentioned by @D.W. is very true. A simple calculation below suggests that all emails with less than 11 characters must be cracked, and I will give a motivation to do so.

The data dump here already contains all the MD5 hashed emails and the corresponding userid. Hence, it would be possible to do a brute force matching and there are someone do has hundreds GPU hanging around. Suppose each top GPU could have 1GHash/s, and there are 100 GPU, and run for 3 days. It gives total H = (10^9 * 100 * 3 * 86400) ~ 2.6*10^16 hash. Also, assuming the character set are only letters (no capital), numbers and some symbols which accounts for at most 40 letter, so log(H)/log(40) = 10.25

It means that all emails with 10 or less characters from major email providers must be cracked already with brute force. Provided you have the equipments, it is easy to do and it requires very low technical skills compared with the "advance skills" like dictionary attacked (which should be harder to parallelize in GPU, I guess). Definitely, more can be cracked if they spend more time, but the basic one is really just hours of setup.

About the motivation, someone might find it fun to do it, but it does cost their time and money to run the equipments. So if they can sell dozens of the userid<->emails list, it would a good motivation. The list might have various use. In particular, with the price and restriction on career.stackoverflow, such a simple list would be very handle for the companies bypassing the system and directly contacting with the candidates. There are various email lists out in the wild and the person using it might not even know where it is from. Also, most of users being contact would not notice that it is leak from here as their emails are likely being reused. Anyway, my point is such list is easy to create and there is enough motivation to do so.

Even though the stack keep saying that emails are private, but they already release the email list, in an easily decoding MD5 which they don't even salt it.

Edit: It could have been harder and make this attempt infeasible if the data dump contains salted md5 hash, which requires attempting one email at a time so my above estimation is for one email only. But with the unsalted hash, the GPU only need blind hashing all combinations and send the results back to CPU which then compares all user emails at once. So it is faster by the factor of #users and make the extraction feasible. The limitation would be memory bandwidth which I did not include in my estimation, but the results only slow down few times depending on hardwares.

The mail address in your profile is private, only mods and SE employees can see it and they are not allowed to share it with third parties. Sharing PII like mail addresses is covered by the moderator agreement, and each access to that information is logged as well. SE doesn't sell mail addresses or something like that as far as I know.

The usual way someone gets your email address if it isn't published in your profile is by correlating your account with another one that has the mail associated. If your user profile contains enough information to identify you, the mail address could then be taken from your Twitter or Facebook account or any other source that can be somehow connected to your account.

In your specific case I can't actually see how this would have worked, though. I don't see enough personal information in your profile.

There are some technical aspects of the Stack Exchange platform that could, at least in principle, allow someone to deduce your email address. I somehow doubt that it's what happened to you, but I'll document it here for posterity, since I haven't seen it written down anywhere else.

In particular, the MD5 hash of your email address is made publicly visible in data dumps and via Data Explorer (e.g., try this query). Moreover, for many people it will be possible to recover your email address, given its MD5 hash. For many people, their email address has relatively low entropy: there are a handful of common options for the domain name, and one can enumerate many common possibilities for the username (one can also use your profile and your StackExchange username to help seed candidates for the username). This provides a large list of candidate email addresses for you. Then, one can use offline dictionary search to test each one against the known MD5 hash, to see if any of those have the same MD5 as your known MD5 hash. Due to the improvements in use of GPUs for password cracking, there are existing tools for this sort of MD5 reversing that are surprisingly efficient. Based upon past analyses, I would expect that many (but not all) users could have their email address recovered.

I haven't seen any place that publicly discloses this risk. I learned about it on a post I made to MSO a while ago that has since been auto-deleted.

That said, while this is technically possible, I don't know whether it's likely that anyone will bother to go to these lengths just to learn your email address. They'd have to download a MD5 cracker, configure it to help it generate plausible email addresses, tweak it by hand, and leave it running for hours. That doesn't sound super-plausible to me.

Bottom line: my expectation would be that there's some other explanation -- that this is not the cause of the email you got. However, I suppose it's possible, in theory.

Due to a technical weakness in the gravatar system, if you use an auto-generated Gravatar, in many situations it would be technically possible to derive your email address from the Gravatar you use. Whether anyone will go to the lengths necessary to do so is less clear, but it is technically possible.

Here's how. The URL to your Gravatar contains a MD5 hash of your email address in the URL. There is no salt in the MD5 hash, so it is possible to do a dictionary attack: guess many possibilities at your email, and test each one to see whether it is correct. If your email address is guessable (and many people's email addresses are), then this would be one way that someone could learn your email address, if you use the default the Gravatar.

I once wrote a detailed technical explanation of this on Meta.StackOverflow, but it looks like the question was deleted (some folks took exception to my characterization of this as a privacy weakness or felt it was covered by prior discussion and downvoted the question, so it ended up with a total score of -2: +11 upvotes, -13 downvotes; as a result it eventually got auto-deleted by the Community user), so you won't be able to read it unless you have > 10K rep on MSO. You can find a less detailed explanation here, but that post is old, so it doesn't take into account the potential for GPU-based dictionary attacks, which potentially change the risk calculus, and it misses some relevant links and analysis.

If I recall correctly, I believe this only applies to people who use the default auto-generated Gravatar. If you upload your own avatar image, it doesn't apply to you. It looks like you currently have a custom avatar image, so assuming this is not something new for you, I suspect this doesn't apply to you and so probably wasn't the way they got your email address. But I'm just trying to document this for posterity, in case anyone else runs across this situation.