In my case it's been from sites that got hacked or were discontinued. I don't investigate every single item of spam to see where it's addressed to, but some of the major data breaches like LinkedIn and Dropbox feature prominently. There's also an address I used as admin for a long-defunct domain.

In practice it's hard to differentiate between the sale of an address and a data breach, especially for smaller sites where the breach may not be publicized at all.