In order for a multiple select list to submit multiple values it has to have a name that ends with []. That tells php to create it as an array so it can hold more than one value, so I updated your select list to name="company[]"
Then your plugin page has to filter with the list of all of the values from the array and not the single value. To do that I updated your recordset parameter from:
$rsCONTACTS->bindParam("il", "".$_GET['company'] ."", "-1"); //colname
to:
$rsCONTACTS->bindParam("il", "".(isset($_GET['company'])?implode(",",$_GET['company']):"") ."", "-1"); //colname
The data type changes from integer (i) to integer list (il).
Then the $_GET['company'] value is combined into a comma separated list using the implode() function.
Making those two changes fixes your lists.
