How could someone access my Apple ID without permission?

Contacts. If you sent anyone your Contacts, it can include the information you have provided there including your email address. Even if you did not send your roommate your contact, someone else may have had it and sent it to them.

Messages. If you have Messages set to send by Apple ID, or if you iMessage a device that does not have a phone number, such as a Mac/iPad, then your Apple Account will be used. Those devices can use iMessage using an email address, but not a Phone Number without a linked iPhone. Another person could have then given your roommate your email address if you messaged another Apple device..

And like you said, anytime you email someone, they will have the email address used to send the email. No permission is needed for that email address to be exposed to the recipient. They may not have got that email from one sent to them, but anyone else you had emailed could give it to them.

With physical access to your phone, then can change Settings on your device with the Passcode used to login. If you suspect they know your login Passcode, then change it here:

Set a passcode on iPhone - Apple Support

If you suspect they know your Apple Account Password, then you can change it here:

Change your Apple Account password - Apple Support

Email addresses are meant to be known by others. That’s a requirement for their use.

Particularly while discussing security though, where did you notice this email account usage?

If you accessed the Android device and found it listed there, some here might wonder about accessing somebody else’s equipment, for instance.

But if the Apple Account usage is visible from your Apple Account and is logged into your Apple Account, then that’s another matter. Maybe Apple Music is involved?

If that Android device is logged into your Apple Account, and you no longer wish that, change your passcode, and change your Apple Account password:

If you think your Apple Account has been compromised - Apple Support

Then check the personal Safety Guide for suggestions, amd run Safety Check there:

Personal Safety User Guide - Apple Support

They cannot access your iCloud Account with your email address only, they have to have the Password to your account and I assume that is not what you found on their device. If they tried to log into your iCloud Account you would get a Verification Code sent to your iPhone if you are using Two Factor Authentication.

So basically, they would need your Apple Account email, Password, and Verification Code sent to your device to log into your iCloud account from their Android phone.