Just remember, there are such things as dictionary attacks. I wrote a brute force walker through ('A' .. 'Z', 'a' .. 'z', 0 .. 9) generating all 5 letter names. It took 238 seconds starting from AAAAA to get to PugSA.
Sending out email is certainly slower, although a botnet of 50000 zombies gives you a certain amount of parallelism. Sooner or later you're going to receive spam, whether your address is "published" or not.
Oh wait, SMTP address are case-insensitive... make that 27 seconds.
• another intruder with the mooring in the heart of the Perl