It seems that they also collect email addresses directly from git repositories: my email address isn't publicly visible on GitHub (in the user profile, that is) or similar services, yet spam with those developer-related products still arrives sometimes (e.g., some kubernetes-related "napptive" thingy, postgrest-related "subzero"). Asking spammers to stop spamming probably won't have much of an effect though.