Christine, you haven't told us yet ..

you got a spam email from them, so they know your email address.

Did the also use your name?

Did they also use your real (snail mail) address?

If all they've got is your email address, then it doesn't necessarily come from urg, nor, as you suggest, does it mean that the one person on urg who knows your email address has had their computer hacked.