They can also just guess your e-mail address.
You know those programs people use to dictionary-attack your passwords? Well, now spammers use similar ones to 'dictionary-attack' e-mail addresses.
I can always tell if they've used this technique, because the spam will have been send to
juju1@foo.com,
juju45@foo.com,
juju1112@foo.com, etc.
With this technique, you never have to give your e-mail address out to <i>anyone</i>, and you'll <i>still</i> get spam.