Speaking of "secret email addresses", I do sometimes wonder how some spammers get them.
I've got a university mail address which I've used *nowhere* and only have told some (IRL) friends about.  And I've received some sPa/\/\ in there.  IDK whether friends' contact lists got bombed, or some internal leak of information but I got some.  Unlikely to be guessed information (it's a student ID).