They spider the web and pick up addresses that way. I kept getting emails from one of my domains from this address
amin@domain.com and couldn't figure it out until I looked at the source code in the site and saw that it had an email addy in their misspelled where it should have been
admin@domain.com.
Was real easy to see how they get their addresses after that
