I have a similar experience. I've been using this system for about 15 years, and have to block one or two address a year due to spam. A couple were due to first

I have a similar experience. I've been using this system for about 15 years, and have to block one or two address a year due to spam. A couple were due to first party spam that I could not manage to unsubscribe from (Cooks Illustrated, I'm looking at you), and a few scraped from forums (didn't realize the email would be public when signing up). The rest appeared to be due to an account compromise (based on breadth of low quality spam) - oh and less than 1/4 of those sites notified me of a compromise. I don't think I've ever received spam from what appears to be a "legitimate" "business partner" which is what I would expect from emails that were sold. I also get a handful of spams a month from default addresses (hostmaster, etc), all of which come from Chinese IPs. I don't have any email address posted on my websites to scrape from (mailto: or otherwise), so I don't get any spam from that. The end result is pretty much no spam. I assumed when I first setup my domain I'd have to configure spam assassin at some point, but that point has never come, thankfully.