Thanks for the replies.
I have set up a rule to automatically delete any email with Wordpress in the sender line, which seems to have stopped most of them. They seem to be using a bot to sign my email address up to loads of websites/mailing lists!
Luckily my BA password is not the same as my other accounts, or my email address, but have just changed them all to be safe anyway.
I have IPVanish vpn app on my phone, but is has trouble connecting in China so didn't bother using it! Oh well, live and learn!