Just remember, there are such things as dictionary attacks. I wrote a brute force walker through ('A' .. 'Z', 'a' .. 'z', 0 .. 9) generating all 5 letter names. It took 238 seconds starting from AAAAA to get to PugSA.

Sending out email is certainly slower, although a botnet of 50000 zombies gives you a certain amount of parallelism. Sooner or later you're going to receive spam, whether your address is "published" or not.

Oh wait, SMTP address are case-insensitive... make that 27 seconds.

The local part of an email address (i.e., the "PugSA" in "PugSA@example.com") is case sensitive. This is specified in RFC 2821. It's a good idea not to treat your local addresses case sensitively, but it's a bad idea to assume a remote system is not case sensitive until you know otherwise.

True, though the spec also mentions that:

. . . exploiting the case sensitivity of mailbox local-parts impedes interoperability and is discouraged.

Spam bots just take random words and stick them in front of a domain name in the hope that it's a valid email address. Maybe it was such an accidental hit?

Anything is possible as you say. I'm only saying, please check it out if other monks have the problem there might have been a security breach and something to look into

I'm using my handle "CountZero" for years now and I do have a e-mail address "CountZero@???????" (that I never use), but I cannot remember ever having received spam on this e-mail address.

One good trick to avoid spam is to refrain as much as possible from using a real e-mail address when subscribing to discussion groups, ...

I found 10 Minute Mail a very good solution. It makes you an email address which is valid for 10 minutes only (without going through the whole administration of opening a Yahoo, hotmail, gmail, ... account) and that is usually long enough to receive the password or activation string.

Devon Hillard --who runs this service-- has the following interesting comments:

When I launched 10minutemail.com, tons of forum admins decried the idea. They screamed that it would let spammers on to their forums, and that they wouldn't sell e-mail lists to spammers, etc...

A month goes by, and let's see what we have. My server used to get around 200-300 e-mail a day. In the past week it averaged 60,000-70,000 e-mail a day. Virtually all of those were to old (expired) 10minutemail.com accounts. Presumably virtually all spam.

70,000 a day!? This proves that the average person simply CAN'T trust a random site or forum with their real e-mail address. Are there some forums/sites that are trustworthy? Sure! Does the average net user have any ability to tell with certainty if a given site or forum will sell their e-mail address or spam them direction? Unfortunately not.

This drives home the importance of the service.

CountZero

A program should be light and agile, its subroutines connected like a string of pearls. The spirit and intent of the program should be retained throughout. There should be neither too little or too much, neither needless loops nor useless variables, neither lack of structure nor overwhelming rigidity." - The Tao of Programming, 4.1 - Geoffrey James

SitePoint is a web design forum and PugSA is a member of it, having joined in 2005. Maybe you joined that back then?

Spam is spam - it is a fact of life in the electronic age. Shame we don't have an EPS the same way we have an MPS and TPS (in the UK at least).

I use a yahoo account when I subscribe to anything. Originally it was just going to be a spam magent but now I mostly check that account for mail. It has trainable spam filtering. You could train a gmail account similarly. They can identify between valid content and spam on the Debian lists