Lately I've gotten some spam emails that link some of my answers/comments on SA. This has led me to wondering if there's some way for SA members to find my email address?
I'm fairly public, so there's other ways they could have done it, but thought I should check.
User emails are quite protected here.
The normal users cannot see your address at all. Moderators have a way of seeing it, but it is "tucked away" on purpose, and I believe that each instance of looking it up is recorded (even when we view the moderator-only parts of a profile, we have to make an additional click to display the email address). Employees (or maybe only the ones with user-facing roles) also have this kind of access. Both moderators and employees have signed agreements to protect your privacy, and these are taken seriously, so I don't think this would have happened via that route - but I have no idea if some automated malware can exploit our access somehow.
There have been a few vulnerabilities over the years, but nothing recent. For example, originally our avatars were automatically created by the Gravatar service, which turned out to be very cavalier about user data. SE has not used Gravatar for some time, but maybe your account is old enough that your email was exposed. See Received spam, leak of email addresses?.
I also noticed that you have entered a webpage in your profile. That is visible to everyone, and if you have your email on that page, maybe there are bots sophisticated enough to scrape it from there and make the connection.
I will inform the Community managers of the situation, because I think that they should know that this kind of thing is happening, even if the connection was done with information publicly available elsewhere. If you wish, I can ask them to contact you, and see if they can find out something more.
