Perhaps it comes from un-encoded email addresses shown on our site (i.e. in about page). They are indexed and stored in a certain mailing list.

I use email encoder plugin to prevent my email addresses from getting this kind of scam.