The amount of information being sold online is massive so them knowing your hometown isn’t weird at all.
If they do contact you again, I’d just make a burner email and get them to send an email to it. Don’t click on any attachments or reply to it, but just do a header trace on it and you can...