I've had an Ethereum address for 3 years and I just counted around 30 spam tokens attached to it. That's remarkably low considering how global and easy it is to send. I don't even want to imagine how many spam emails an unfiltered address would've gotten in that time span.