This question already has an answer here:
I typically use a different email address for every site that demands one. It's an additional factor I use to authenticate that this particular email really came from a particular site. Many of these addresses are used only once, forever, when verifying a signup for the site.
There is one flavor of spam that kicks in from time to time, where I receive many identical spam, addressed to many of these unique addresses.
How were these addresses collected by the spammer? Am I to believe that all these sites have independently had their email databases stolen? Or perhaps that they all share an email provider? These providers include both very large and very small sites.
BTW, I've occasionally tried sending friendly "I have evidence that your email database has been stolen" messages, and you can guess how effective that has been.
While this is similar to the cited "duplicate", neither question has been satisfactorily answered.