I posted a thread about this a while ago. I get spam on a PPRuNe only address - which has not been made public. It's either been grabbed from here, or from the mailservers at 1&1 - my domain host.
It has never, ever, been shared or published. It doesn't even "exist" in the true sense - I have a catchall account for <anything>@mydomain.com. The good news is that I can change the address as necessary and tweak the spam filter once it gets rumbled.