Spammers sometimes bumble across real addresses by randomly creating names in a way similar to yours. They don't care if it's a low-yield enterprise, as long as it's not a zero-yield enterprise. You may be slowing their spiders, but are you assisting their name guessing?

Your legit-spider check is a multiple line regex without the /x modifier. Are you sure you're matching what you think you're matching? And what happens when spammers adjust their spiders to spoof a friendly google spider?

Tiny nit: your comment says you're choosing 1000 words but you pick 2000 instead. Don't include any magic numbers in comments, they're just prone to become stale as you adjust the code. This falls along the lines of my maxim, "Strategy in comments, tactics in code." The code snippet in question is already near-literate, so why babble? Save the comments for things that aren't visually obvious: the setup is heavy with comments but the main loop needs a little help.

--
[ e d @ h a l l e y . c c ]