It could also be from the webmail based system. I remember opening one of those for the kids many years ago, and within 5 minutes the spam started arriving. Closed them down immediately.

I would hope that BA has as good a firewall system and data protection policies as most UK based corporates. If their marketing people are any like ours they have a holier rthan thou attitude regarding DP, and you can't use any email address unless it's been sworn with a affadavit by the owner and signed in his children's blood.