Not sure, but an alternate explanation is that spammers are now emailing brandname@[domainname].com. I've gotten emails along those lines forwarded to my catch-all email address.
You can also use brandname+randomnumber@[domainname].com to more definitively test if your email has been sold or compromised by a particular website...