While no expert on spam I believe there are two main ways these ba5stards find email addresses.
The first is to use computer programs to scan the web and websites looking for email addreses. One they find one they add it to their database.
So if you write your email address down on a web site dont write it as: myname@myaddress
You should write it as: myname AT myaddress
Secondly they "guess" at an email address.
So they know hotmail is used by many people, so they just send out email randomly to computer generated email address such as
[email protected], aa@hotmail com, down to zzzzzzz@hotmail com and everything in between.
Many of these of course a "lost" in the system but as long as they find enough genuine ones they dont care.
As Ethel says, the more "random" your email address is the less likely they are to use it, so this address below is not likely to be guessed at:
[email protected]
(I believe there is no problem in using a full stop and an underscore in an email address)