[bombcar]

There are many many of these and people use them all the time; most people at the levels they're being hit don't have time to wonder how you got their address (and for many, many companies it can be as simple as guessing their address format from other available ones, something like first.last@company is pretty easy to work out).

And if these people ever go to a conference, they likely hand out business cards with their info on them.

[notahacker]

When it comes to scraped data it's usually even simpler: the scrapers got the email address from the website which lists their email address as the tech/marketing/sales/hr contact for their company, which is out there because sometimes people need to approach them with things which are legitimately relevant and of interest

Always mildly amusing when you get a pitch which refers to your website by someone that obviously hasn't visited it though...