You never subscribed to half the senders flooding your inbox, yet loan offers, crypto pitches, and "exclusive deals" keep landing—even in addresses you created specifically to stay quiet. Filters treat symptoms; the root cause is simpler: your address is already on lists built by an industry that buys, sells, and re-sells email identities. Below are five leak paths that feed those lists, what each looks like in practice, and how to respond without giving up email altogether.
Path 1: the signup you forgot about
Every form field is a data deposit. Free PDF, coupon code, webinar replay, loyalty program, free-trial SaaS—the moment you submit, your address sits in someone else's CRM alongside whatever else they inferred about you. Ethical companies mail you themselves; less ethical ones sell list segments to brokers, append your row to "partner offer" campaigns, or leak entire databases through sloppy access controls and departing employees. Months later a brand you never heard of greets you by a nickname you typed once—that is resale, not coincidence, and it explains why the subject line feels unnervingly personal.
What to do: Before typing, ask whether this site deserves your real inbox. When the answer is no—or "not sure"—use a temp address for the download and walk away; the list they sell expires with the inbox. For shops you might order from again, use a dedicated forwarding alias instead of your primary address so you can pause one sender without migrating your life or rebuilding filters from scratch.
Path 2: someone else's breach, your problem
Even careful sites get hacked. Breach archives circulate billions of email and password pairs for years; attackers merge dumps, deduplicate, and tag confirmed-active addresses that still accept mail. Spam is the mild outcome—credential stuffing against reused passwords and spear-phishing that cites an old purchase date are the serious ones. You cannot patch a retailer's servers from your side, but you can ensure any one leak exposes only an address you are willing to burn.
What to do: Check haveibeenpwned.com periodically for addresses you care about. For everything else, assume breach-level exposure from day one and sign up with identities you can discard—never the same inbox you use for password resets at your bank.
Path 3: harvest bots reading public pages
Posting you@company.com on a portfolio, GitHub profile, conference bio, or job board is like taping your number on a telephone pole. Harvester bots scan the open web 24/7 for @ patterns; obfuscation like "name [at] domain [dot] com" fails modern regex and may even flag you as an outdated target worth extra scraping. Within weeks expect generic SEO pitches, recruiting templates, and the occasional cryptocurrency "partnership" that begins with flattery and ends with a wallet address.
What to do: Public contact points should be forwarding aliases, not your personal inbox. Bots can scrape them; spam hits the alias. When volume becomes unbearable, pause that alias and publish a new one. Your real mailbox never appeared on the page.
Path 4: the unsubscribe button that confirms you exist
Legitimate CAN-SPAM mail usually honors opt-out. Gray-market lists treat a click as proof a human actually reads the mailbox—verified-active addresses trade at a premium. Loading remote images sends the same "opened" signal, which is why clicking unsubscribe on a shady blast can increase volume instead of stopping it.
What to do: Unsubscribe only from senders you trust to actually remove you. For obvious junk, mark spam and delete without interaction—no links, no images, no "manage preferences" curiosity. Better still, never give those senders a high-value address in the first place; a burner or alias absorbs the experiment so your core inbox never enters their validation pipeline.
Path 5: friends, referrals, and forms filled on your behalf
"Invite three friends, everyone gets $20" uploads your address without consent. Greeting-card sites, team signup sheets, school portals, and coworker-filled lunch-order forms routinely collect third-party emails you never agreed to share—the platform stores them anyway and may treat them like any other marketing lead. You cannot control this path directly; you can only limit the damage when it happens.
What to do: Treat your outward-facing address as replaceable. If a referral promo poisons an alias, delete it and mint another in seconds. Rebuilding a decade-old primary inbox after it becomes a spam sink takes weeks.
Build three layers instead of playing whack-a-mole
Five paths, five habits—but remembering five rules at every keyboard moment is exhausting. Compress them into a tier system so each new signup gets an automatic default instead of a fresh decision:
| Tier | Address type | Use for | If it leaks |
|---|---|---|---|
| Core | Real primary inbox | Banks, government, employer, close contacts | High impact—protect fiercely |
| Buffer | Forwarding alias (one per service if possible) | Shopping, newsletters, forums, anything recurring | Pause or delete the alias; core stays clean |
| Burner | Temp mail | One-time codes, trials, PDF gates, sketchy forms | Zero—address self-destructs in hours |
Default downward: start with a burner, upgrade to a dedicated alias only when mail must keep arriving, and reserve core tier for people who already know where you live. Pick the next three signups and assign a tier before you click submit; delete dormant shopping accounts that could leak again; cancel newsletters you never read and re-subscribe through an alias if you still want the content. After a month, primary inbox noise usually collapses—not because filters got smarter, but because the address stopped circulating.
Spam is a list business. Lists fill through signups, breaches, scrapers, bad unsubscribe hygiene, and social leakage. You will not shut down the industry—but you can remove your real address from circulation and make every future leak cheap to contain. RemailGo covers the burner and buffer tiers for free: instant temp mail on the homepage, up to 100 forwarding aliases with 30-day archives and one-click pause when a sender misbehaves. Spend five minutes setting tiers once; spend years with a quieter inbox and a clearer picture of who actually earned your trust.