Don't forget robots..
I think it's easy to forget that spam can hit non-public email addresses, sometimes even those that have never been used, too. The robots simply generate a list of hundreds of thousands or millions of potential addresses for any given domain and when targeted they get bulk sent. Only a few small per cent will find a correct recipient but that can still hit thousands of customers.