It sounds as though you've handled your email quite well.
The problem of people forwarding to long mailing lists is a perpetual one, and we've had to be "quite forceful" with a couple of people to at least minimize the amount of that kind of stuff. As you say, they must realize that they are publishing the address of everyone on the list, everytime they do that.
Most of the methods spammers use to collect addresses are pretty much "legal," even if not ethical. Intercepting email falls in the category of "possibly not even legal," but it is done, and apparently is not too difficult.
Outlook and Outlook Express get something of a "bad rap" simply because so many "persons of less than moral character" seem to have a hatred of Microsoft, and because it's widely used; so "cracking" an Outlook feature has more "impact" than getting into something less widely used. Recent meetings of "the guys that worry about spam and viruses" have brought out concerns that many other programs that have enjoyed "immunity through anonymity" have some serious security flaws - even worse than in current IE, OE, and Outlook.
A particular concern is discovery of very serious "loopholes" in the Unix and Linux operating systems, and evidence that the hackers and spammers are beginning to increase their attacks on them. The number of "corporate" and "server" users of these systems, and fairly widely known vulnerability, makes it a real concern in any "terrorist" scenario.
Many of us doubt that a Federal anti-spam law will have much effect, since it's so easy to move out of the country to get "immunity." Many of the main spam distributers, while located in the US of Canada, route all their "message origination points" via servers outside the continent already. For now, it's mainly because it's easier to find an "offshore" ISP that won't kill their account if too many people complain.
And the same problems occur with the (telephone) telemarketers. You just don't see the whole list all at once when you go in for your mail.