Spammers get email addresses in lots of different ways, including:
(1) simply guessing. i.e. they'll put combinations of initials/forenames and surnames in front of known domain names. (That's relatively unlikely with a business domain name but might still occur, especially if it's that of a major company or public body) ;
(2) by scouring web pages for them. (So, if your email address is on a 'Contact' page for your company/organisation, it could have been sourced from there) ;
(3) using hacking software to access address books on computers. (So, if your email address is stored on a compromised computer of a customer or client, it could have been copied from there).