Suppose a would-be spammer grabbed a load of usernames, say from the who's online' page at different times, then attached them to various@xyz.com'-type appendages, and sent them out at random.  Would that explain any of this?  It would, only if members have their usernames as part of their email addresses.  So do any of the spam-victims here do that?

I don't, and don't ever get spam, though of course that proves nothing.

I do get ebots, the newsletter, notification of comments etc., but almost always uncheck the `Notify me..' option on forum posts.