Most of those shady databases are data collectors. Sometimes I see those on domain wide reports for names even if the user never actually had that email address

Most of those shady databases are data collectors. Sometimes I see those on domain wide reports for names even if the user never actually had that email address. Sometimes it's just a guess. Ex: You might see joe@mycompany.com in the report for those db, even though Joe Smith only ever had joe.smith@mycompany.com. And sometimes its legit scum collection. Some of the spam you get is just verify what email addresses work and what don't. If it doesn't bounce, you know you got a valid email address. Works for a lot of businesses (but not if you've got a personal catchall)