Some spammers just try a dictionary of combinations looking for a hit.

Eg:

[email protected]
[email protected]

It's possible that this is how it got to you.

One of my favourite techniques is to use myemailaddress+<siteaddress>@domain.com. For example, [email protected] to sign up to sites. That one really lets you know who's selling, as most dictionary attacks won't use the + sign designation in their routines.

Just food for thought