The harvesters love to have automated processes that read through every website in the world extracting strings that look like addresses.
Not only that, but they now try to "brute force" the plausible name space, i.e. they try alan, andrew, bob, charlie, dave, etc. and combinations and permutations thereof at each domain, in the vain hope that they will "get lucky". Thus people with popular names (or rather mailnames with combinations of popular words in them) are more likely to get hit even if their address
isn't published anywhere. Of course that doesn't mean that if your mailname is
[email protected] you're going to be immune...
[and yes, it is safe for me to publish that made up address above: example.com is reserved precisely for published, well, examples
]