@Griffin - No, I've never received spam at an obscure email address - That's exactly my point.
Or rather, when I do receive spam to the unique aliases that are only associated with one company/account then it's because their database has been compromised.
For example, I have many such aliases for shopping sites, amazon, dropbox etc.. Most of these have never, ever received spam. Last year, I started to get spam addressed to the alias uniquely associated with Dropbox. I complained. Two weeks later Dropbox admitted that it's email database had been compromised. I closed the alias.
A key point here is that my alt has an alias email address on an entirely different domain to my primary avatar - and yet they both received the spam at the same time. Both aliases have only ever been used for SL - neither have ever sent email, and my Alt's account has not received an email since I created it - until the spam today.
@Karen - Good points - My PC is clean - and I have "real" email accounts that have never received spam on the PC. The Viewer issue may be relevant - I use Radegast, MetaVerse and Firestorm. Possibly a leak there - although so far the accounts themselves have not been accessed - they've just started receiving spam.
I don't receive spam at all, but if I did get an SL account phishing email, then it would have to have been addressed to one of my aliases in order for me to take any notice of it - and my Alt has never received any email.
Your last point is a very good one - My Alt's email alias has been the same for some years. I changed my Primary avi's email alias about six months ago.
Naturally, I will be changing both aliases and equally naturally, I wouldn't expect LL to ever admit to any data breaches!