OK, so the following happened: 1. User got spam 2. GoDaddy ... provid(es) spammer with the user's email 3. Spammer ... using the email address GoDa

OK, so the following happened: 1. User got spam 2. GoDaddy ... provid(es) spammer with the user's email 3. Spammer ... using the email address GoDaddy provided But wait, how did step one happen? Spammer must have had user's email, as a pre-requisite to sending said spam via email (presumably) in the first place? I'm confused. Or am I missing something important?