Scammers use sophisticated spybot programs to trawl many billions of webpages to harvest addresses. Poorly-regulated forums with a lack of security consciousness, are a classic. It only needs someone to make a comment that your business is recommended, and put up your complete email address on the forum with the ampersand included, and it can be harvested by spy bot programs.
Many businesses have a lackadaisical approach to internet security, and put up webpages with lots of useful info (for their own internal requirements), and then fail to understand that anyone with a computer and internet connection can access them.
I once discovered a webpage (easily) with a huge list of business owners names, addresses, phone no's, email addresses, etc., that had been put up by a business I had once purchased a small item from. I was stunned to find all my contact and personal details there. I was appalled, and immediately emailed them to get them to either take it down, or put immediate, controlled access restriction on it. It did get taken down eventually, but possibly not before a lot of scammers did some high-fives over finding it.