I use unique addresses for almost everyone, and the spam fits a consistent pattern. Mostly, the emails don’t get sold unless I order from a somewhat shady site

I use unique addresses for almost everyone, and the spam fits a consistent pattern. Mostly, the emails don’t get sold unless I order from a somewhat shady site (grey market items not regionally available for example). Most of the time when I get spam from a ‘legitimste’ source, it’s right after a news announcement about a data leak. For example, my PayPal address gets a bunch of spam, and that happened after some user leak many years ago.