Again, another simple mistake: you must always have the "Hide email address from public?" option checked in "Account Related Settings" so that no one can see the email address attached to your account when they check your public profile.
In this case I believe the email address was hidden, the service provider when they gave the address to someone else, they must have been able to view previous emails received and sent. This is my best guess on how they were able to link it to the forum account.
I also wonder how a person can create the same email address provided to someone by a specific service, in your case, the VPN service. If they were to buy the same promotion, they would probably not be allowed to have the same email address as yours.
Services do this for free email or phone number offers, they can always rotate this around to other users when the free promotion expires. Some can have more than one person using an email or phone number a the same time.