The site operator may not ever tell you if they were hacked, or sold your email in a dirty cross-marketing campaign. It is possible that the people you would r

The site operator may not ever tell you if they were hacked, or sold your email in a dirty cross-marketing campaign. It is possible that the people you would report this to may not even know if they did this intentionally. If it was from a cross-marketing dirty list, only the web marketing people may know, if even then. In my opinion, just flag that address as spam and set a rule to either discard their emails or put it into a "compromised" folder. If you want to give the the benefit of doubt, then find the legal/security/report-fraud links on their site and let them know. Maybe you will get an authentic human response.