iCloud Email Address - Being Used by Someone Else

Hello, I’ve recently began getting notifications from services I do not use (temu, facebook, instagram, Spotify etc) on my iCloud account. My original Apple email address used to end in .me when Apple made the switch to iCloud I was given a new email address that matches my original username just with .iCloud now. I have no other devices I do not recognize signed into my account and 2FA is enabled. Has anyone else experienced this? One of the emails I’m getting is from WorkDay so I have to assume maybe that this person is able to get in and check this? It’s an odd issue I was hoping someone knew what is going on. Thanks!