Hi @iami,
there is nothing like an intermediary address. You’ve become a victim of a so-called address poisoning attack.
For more information please check this thread: Has my trezor been hacked ?
You can find more information on address poisoning attack in this article: https://trezor.io/support/a/address-poisoning-attacks