Things don’t just crawl out, they need to be activated/run and to do this from a mail server is highly unlikely even it it had been hacked.

You’re more likely to have what I have already covered, receipt of spam, social engineering scams or phishing emails. These may come with links to suspect sites where you may come into contact with driveby attacks or trying to get you to open attachments.