If you clicked on a phishing scam, you may have accidentally given a malicious third-party app access to your Google account. This malicious app might, for example, send more scam email to all of your contacts.

To check which apps have access to your Google account:

1. In Gmail, click your user icon on the top right
2. Click the My Account button
3. Under "Apps connected to your account," click "Manage Apps"
4. Remove any apps you do not recognize