First mistake was emailing them back, they now know that
its a real email address. I never give out my real email through
my provider, I think my bank OSO a few business accounts,
Always use a hotmail or yahoo account for purchases or
general Info, I give mine real one to only a select group.
Another way they get your address is forwarded emails
if you ever had a email Jokes fwd to you, you'll see a list
of addresses in the To/cc when I foward stuff I remove all
of the other email address.