Unless the spam is coming from the site you're visiting or that site already knows your email address, it's unlikely that site is to blame. In fact, unless you've associated your email address with some service that is a partner of the site you're visiting, there's no way for them to even get your address (i.e. whom did you actually tell your address to?).
Instead, a more likely scenario is a local compromise within your browser or otherwise on your machine or local network. Software running locally could scrape your address from forms you've filled out, and then could watch your activity no matter where you go or what you do -- no VPN or encryption or anonymizing service can offer any sort of protection if the attacker controls your computer.
Many people unwittingly install browser extensions; toolbars, "safe search" extensions, or other helpers as part of other software installs. The less scrupulous the software's distributor, the more likely these things get bundled in. Any such software could easily do this and much much worse.
Likewise, such software can be installed by infected websites using such vulnerabilities as the Adobe Flash zero-day vulnerability patched yesterday for Windows, OSX, and Linux. If you have Flash installed (and you likely do), then your browser was and probably still is vulnerable and being actively exploited by malicious websites.