Early versions of some browsers gave away email addresses routinely. A quick and easy way to check for this is to visit our privacy check page that displays these headers. If your address is being disclosed, reconfigure your browser or use a free product such as Internet Junkbuster to block it. Check that your ISP or company isn't running the identd demon, a background program that Web servers can ask for your user ID while you wait for a page. It was originally intended to restrict access to authorized users, but spamming sites can use it to guess your email address.
Some larger companies sell or give away email addresses.
Most have policies and terms that prohibit use of their information for spamming, but this doesn't seem to stop some spammers. You can tell email lookup services such as those listed in Yahoo to remove your name and email address. Some of the giant companies that sell mailing lists to catalog companies are now also selling email addresses. The instructions given in spam to have your name removed from the spammer's lists are often bogus. All these companies have strict policies against spam and should terminate the account promptly, if it is really being used by a spammer.