Not everyone hides there email in there profile so any bot can signup and grab those. But that doesn’t answer all the questions. Maybe theres a hole in SMF somewhere… This forum is still using 1.1.5 while 1.1.10 is out. So I believe this would be the problem…
As people have pointed out… we’d all be getting spam then.
I can’t verify that though; I get approximately 2,000 spams a day now, from everywhere.
Cas 
I have several different email addresses forwarded to my gmail account, and filtered into different labels. The one I use for JGO is also one I’ve used in quite a few other places (and would happily abandon if it started getting badly spammed). Since the gmail labels also get applied to spam, I’d probably notice if that address was receiving spam; at the moment, it doesn’t seem to be.