LH -

The vast majority email addresses on the spammers lists are not put there because you gave your email addy to a "reputable" site. Of course, when you give your addy to the Turbo Tax people, every brokerage house that has an account with them will get it, and will send you at least an occasional offer, but for the most part the circulation and distribution of these addresses is pretty limited.

Spammers do launch "crawlers" that look for addresses posted on discussion threads like this one, so putting your address up in a forum is likely to get you on a list. Especially if (unlike here) it's a list frequented by "gullible" people.

Some of the spam lists are produced by someone hacking into ISPs with poor security; and there have been reports of "ungruntled" employees selling legitimate lists; but most are "generated" by simply "making up" addresses, sending a message, and keeping a list of the ones that get delivered.

There are only about 12 million possible combinations of 5 letter "names." Pick the "top twenty" email providers, and you've got about 240 million possible addresses. It's about an hours work - or a very few hours at most - to send a message with a "click here to be taken off our list" to every one of these possible addresses with a couple of decent machines and a fast connection. And you don't have to sit around and watch while the machines do the work.

If 10% of the possibles are "good" addresses, you've hit 24 million names worth possibly 0.01 cent each. If 1% of the good ones are naive enough to hit the button, you've confirmed 240,000 addresses, worth about 0.3 cent per address - $700 for a couple of hour's machine time. (The market price fluctuates, and you do need to know where to sell your lists.)

It might take a whole day for some kid's machine to run the 6-letter possibles while the kid's at school - or at his school's computer club where he's sharing how to do it with a dozen of his buddies. (They'll probably leave the school's computer(s) running overnight too, if they think they won't get caught.)

One of the "pro" spammers recently was reported to have claimed his (few hundred - off shore, of course) servers could - "if he wanted to" - run all likely 10 character addresses in "a day or two."

John