A company I worked for got its email list leaked when the email service they used was breached. The email service posted a "we're investigating" in a blog post on a blog that was soon mysteriously deprecated/taken down.
Microsoft sells the shit out of your email address. If you sign up for Dev Essentials you can't even opt out of emails from "partners" unless you leave the Dev Essentials program (and I'm sure leaving it wouldn't actually stop the emails). The only spam I get at my work email (with spam filtering turned off) is tied to that program.
* dbox@mydomain.com (Dropbox) - first received spam two years ago.
* (Greenheart Games/Game Dev Tycoon) - highest quatity of spam after contact/info/admin
Although I just checked and the Greenheart Games address is in a mod's package.json so probably not their fault