I have held more than a dozen hotmail addresses, and some have been spammed to death whilst others receive only a few spam. I doubt that M$ really SELLS your address, although who is to say what happens if an M$ employee lands a job with an advertising company. However, the truth is probably a lot simpler. Spammers gather their addresses from hundreds of sources, and there are now some very large compilations of valid e-mail addresses on CD ROM. All you have to do is give out your e-mail address to one firm, or buy a domain name, or leave the address somewhere, like ICQ or a bulletin board, and your address is at risk of being entered on the next free CD Rom of e-mail addresses.
However there is something more obvious. Since virtually every hotmail address that you can think of is taken, spammers can simply GUESS your address. They have millions of words, and numbers that they can combine by computer in every possible way, then they simply elliminate the bounces. Every one, two, and three word combination in the dictionary, as well as all names and numbers have been tested to find working addreses. Your best bet is to try a really weird and unusual combination that won't be eaisily found by a computer, such as
[email protected]. All combinations of letters and numbers less than about 10 digits have been tested and tried. A better bet is to have a different address, unrelated to hotmail, where there are too few users to justify guessing names (i.e. not AOL).