How spam lists actually get your email, and how to stop them

Published June 10, 2026 · TossMyMail

Spam does not appear by accident. Your email landed on a list, and the list is being sold or shared. Knowing how it happens makes it easier to push back.

1. Data breaches and credential dumps

Many of the biggest data breaches in recent years exposed hundreds of millions of email addresses, sometimes with passwords. The data ends up on dark web forums and gets bought, sold, and combined into bigger lists.

You can check whether your address has appeared in a known breach by visiting Have I Been Pwned, a free service run by security researcher Troy Hunt. It tells you which breaches your address is in. If your address shows up, change your passwords for those services and turn on two factor authentication.

2. Sold or shared by services you signed up for

Some companies share or sell their email lists to partners. Their privacy policy may allow it. Even when they do not sell, a small startup may share lists with a parent company or a marketing partner. After enough hops, your address ends up in places you never agreed to.

This is one reason an alias per signup helps. If you start getting spam to shop+example@yourdomain.com and you only used that address with one shop, you know exactly who shared it.

3. Scraped from public web pages

If your email is posted in plain text on a public page, like a personal site or a forum profile, bots will find it. They crawl the web looking for anything that matches the pattern of an email address.

If you must post an address, use an image of the address, or write it in a way bots cannot easily parse, like name [at] example [dot] com. Better yet, use a contact form.

4. Address guessing and dictionary attacks

Spammers also guess. They generate millions of common combinations like firstname.lastname@gmail.com, or first.last@company.com, and send to all of them. If your address fits a common pattern, you will get spam without ever posting anything anywhere.

There is not much you can do about this, but your email provider's spam filter catches most of it. Mark anything that slips through as spam so the filter learns.

5. Apps, contests, and quizzes

Quizzes that ask for your email to show your result, contests that promise a prize, and apps that ask for your contact list are all common ways data is collected and resold.

Avoid these unless you trust the company. If you must, use a disposable inbox, like the one TossMyMail provides. That way the email you give is not connected to your real identity.

How to slow the flow of spam

1. Use unique addresses per signup. Aliases for things you may keep, disposable inboxes for one offs.
2. Set strong unique passwords with a password manager. This limits the damage from a breach.
3. Turn on two factor authentication for your email and key accounts.
4. Use a tracker blocking browser or extension to limit data going to advertising networks.
5. Unsubscribe from senders you do not want, instead of just deleting their messages. Real businesses have to honor unsubscribe under laws like CAN SPAM in the US and GDPR in the EU.
6. Mark spam as spam so your filter learns.
7. Report addresses that abuse the unsubscribe rules to your email provider.

What to do if you are buried in spam

If your main inbox is unusable, do not delete the account. Instead, set up filters that route promotional mail into a separate folder. Make your main inbox only show messages from senders you have replied to or marked as important. Spend a few minutes a week reviewing the noise folder.

For the most stubborn senders, search the message for a phrase like contact preferences or manage subscriptions. Sometimes there is a master opt out for an entire ad network that stops dozens of senders at once.

The long term goal

You will never get to zero spam. But with unique addresses, password hygiene, and a habit of using throwaway inboxes for risky signups, you can shrink the flow to a level you barely notice.