Visit https://haveibeenpwned.com/ and put in Patrick's address. Looks like this is from the Onliner Spambot breach.
https://www.troyhunt.com/inside-the-massive-711-million-record-onliner-spambot-dump

You haven't confirmed Stern was hacked until you know their systems were broken into and accessed by people purposefully trying to break into Stern.

All you know is at least one Stern employee got some malware that harvested email addresses. That is not being hacked. Malware is a common occurrence in today's society. Worthy of a PSA. You're going overboard.

No one said you're a liar. So far you're just a little hysterical about some common malware. If you continue to repeat bad information now that you've been told the correct information then you would be a liar. Ignorance is easily remedied with some education but it's up to you to fix it.

Your Received: headers show the email originated from IP 212.41.96.38, which resolves to solnet.ch. ch is assigned to Switzerland. The spammer could have an account there, could have compromised a machine that has an account there, Solnet could have a vulnerable system that allowed unauthorized usage.

Note that sheratonparco.com is probably faked. The domain is real but likely doesn't use Solnet for their email.
https://whois.icann.org/en/lookup?name=sheratonparco.com

An address book. Every email program uses one.
https://securelist.com/threats/email-worm/