Could any number of places. Could be a brute-force dictionary attack: I see spam attempts in my logs of 'billa@, billb@, billc@' etc. Could be a compromised zombie PC of someone who had your email addr. Could be from a posting you made somewhere with your email. Could be from data mining this BBS. Could be meat, could be cake.

I'm afraid you're right Thom. Besides...the deed is done. Kind of like worrying about where you caught the cold after you've got it..