Spammers often obtain e-mail addresses from other fansites and will use them to phish information to compromise your account. The theory about the mass-hackings in Diablo 3 stems from this as well; a hacker got into an unsecure website/forum and obtained a bunch of e-mails and brute forced the passwords of the people who didn't have authenticators.