I haven't asked them about it because I don't particularly care. I gave that piece of information to Kiwibank when I informed them of the phish and left it up to them to choose how to deal with it.

I signed up to undertheradar for one concert, doesn't bother me if a disposable email address gets spammed... That is what they are for.

I very much doubt an infection in any of the computers I use. Also the email address used was dedicated to that site. It is possible that someone guessed the email address, but I doubt that as well. Besides, had the email addresses been harvested at my end, I would be receiving thousands more of them at other addresses, plus the one email address I do actually use as a Kiwibank customer.