I had something similar happen to me a few years back. Someone using my photo and profile from my personal site and uploaded it to upwork to get contract work. I found out b/c someone hired them for a contract (thinking they were me) and got suspicious. The employer found my real email on my site and contacted me. Not sure what I can do to prevent it. I put a warning on my site saying to look out for impersonators.