I checked your site, and you seem to be using 2 different subscription forms at the moment: the one at the bottom is provided by Jetpack, but the one at the top is a different form, provided by Mailchimp.
I can’t help you with the Mailchimp form subscribers, but I was able to check our logs for your Jetpack subscribers. It appears we haven’t sent anything to any of your 3 email subscribers in the past month, as you haven’t published any new post in the past month.
That said, you can rest assured: the email addresses of your Jetpack subscribers are stored on WordPress.com, and not shared with anyone; no one but you will be able to send emails to those subscribers, whenever you publish a new post on your site. If those 3 people started receiving spam, it wasn’t sent by Jetpack, and we didn’t share their email address with anyone.
Could you ask your subscribers if they signed up using the Jetpack Blog Subscription form, or the other form on your site?