Lots of organisations sell on addresses. Hotmail used to do it regularly.
The smart way around this is to have your own domain and just make up the bit to the left of the @ for each different website. Then if somebody spams it, you can set up a kill filter on it.