I came to the same conclusion for the same reason (an address I've only ever used for communicating with xfinity). I don't recall the exact time span however as

I came to the same conclusion for the same reason (an address I've only ever used for communicating with xfinity). I don't recall the exact time span however as I did the usual, disable the address and move on with my life (and I no longer use xfinity) and delete the spam. The more interesting part on this is that it's not listed in HaveIBeenPwned as a breach / leak, which means Comcast / Xfinity don't know about it (or are keeping quiet), and it hasn't been widely released anywhere. Both options are pretty odd to me given the spam. This also implies either Comcast / XFinity don't have honeypots for customer info leaks, or they don't care about breach notifications. Note, while this is just one extra data point, I can't add more detail than the above to help your specific case.