Anybody can see new domain registrations, at least in mainstream extensions like .com/.net/.org. This is public information and you could even compile this data for yourself using zone files.
You can even apply for zone access straight from the registries. Example: Verisign TLD Zone File Access Program. Note that the rules vary from one extension to another. For instance most country code extensions (eg. .ca .fr etc) will not release their zone files or severely restrict access, but some however do publish lists of new or deleted domains on their websites.
The modus operandis of spammers is this:
- they obtain the list of new domains on a daily basis (from zone files, public lists, or otherwise)
- they scrape the whois record for each new domain
- they start spamming
There are plenty of legitimate reasons why people (including myself) use zone files, for example for research purposes, trademark enforcement or if you are running a search engine and need to discover new contents etc.
Of course the downside is that registrants are left open to spamming and unwanted exposure of their acquisitions (many people probably do not realize data mining is going on and the data is going to be archived somewhere). You can now expect to receive dozens of spam in the next few days for SEO services or web development services from India or USA (allegedly).
TL;DR: The registrar is not to blame here. Your experience is very typical and unfortunately normal.
It is a good idea to use a dedicated E-mail address for the whois record and possibly list a virtual phone number and a P.O. box in case somebody needs to contact you. As per Icann rules, you must maintain accurate and truthful whois data but you can avoid exposing yourself whilst remaining reachable.
I would not recommend using third party whois privacy service for reasons that are too many to explain and beyond the scope of your question.