Same thing happened with me on GoDaddy. I used GoDaddy's domain purchase system to negotiate and buy a domain, and transferred it to Cloudflare. A few years later, a GoDaddy buyer contacted me about buying the domain. The only way they could have gotten my email is to trawl through their past purchase records since the domain wasn't using any GoDaddy systems (DNS, email, etc) after it was transferred out.
I sent a very unhappy email back to them and I've been transferring my domains out to other registrars. I no longer recommend GoDaddy.