They can get your contact list in several ways. They can set their computer to "force" your password. Their account tries thousands of password combinations until one works. Or they can send you an email asking for you to click on a link... and the link gets them into your email. Or they get into the entire email system which happened to a major email provider in 2014. Or they get into your friend's account and open one of your emails to the friend that is copied to many people.... they scrape all of the addresses.
But you said that "both" of the spam senders were your trainers. If the spammers had gotten into your account they would not have stopped at 2 people. They send an email from every single contact on your account. In hopes that you open one of them. Or they send out a spam to everyone on your contact list. Anyway, I don't think that your account is in any danger. To make sure, you can change your password.