It’s a good question. Where do spammers get your address from? Obviously, it can be from websites you have signed up to selling their databases. Also if its posted on the net anywhere, such as a forum, then crawlers that go round the net searching will find them. I’m not sure I buy the random spamming of addresses on a domain theory. It could work for them to find active addresses if they were sending from an address they can receive on.
However, I’ve got an address at work that has recently been picked up by spammers, and our mail server is set to not bounce any emails. If it receives an email from an address that does not exist, it just deletes it. I have not used the address on any websites. The only other way I can think of is people who I have emailed, have then been infected with a virus or worm of some kind, which has then harvested my address from either their address book, or simply by picking up all the addresses from all the messages in the email client.
Personally, I think the scumbag spammers need to be stopped. It should be done through legal proceedings where-ever possible, and other means where not. Unlike most other crimes, there is a single selfish little individual, causing annoyance to millions of other people just to make a few dollars.