Your PI (personal information) is your PI, and in the 21st century you can't really avoid to spread it around everywhere. That means when someone has your PI it's hard to find out from where they might have gotten it. In some countries you have a legal right to ask companies to tell you, but that obviously only works if the source of the email is easily identifiable, which is usually not the case with phishers and other criminals.
What I do to identify leaks of my PI is to give every website I use a different email address. You can do that if you register an own domain name and then configure its email server to catch-all. That way all emails which arrive at that domain go to one mailbox and you don't need to create a new email account for every website. Yes, this costs money if you don't need a domain name with a mail server anyway, but not having to endure the advertisement and privacy infractions which comescome with most free email services is worth the price of admission alone, IMO.
So whenever someone asks me for my email address, I give them an address in the form [theirname]@[mydomain]. When someone wants to phish or spam me, they will usually do that to the email address which came with the dataset, so when I suddenly receive spam on an address which I only gave to a single website, I know who either lost or sold it.
A drawback of this scheme you need to be aware of is that registering a domain means to put your PI into the public WHOIS database. So anyone who realizes that you do this, can find your personal information from your email address. But fully automatic data-miners will usually not be able to connect these dots because they have no way to be sure that you are the only person who uses email addresses for that domain. But if you want to be safe, use a register-by-proxy service.