I separate emails, a different address for each company/organisation I deal with. Since I started in 2002, I have found multiple instances of leaked or sold email addresses. My Dropbox one was leaked for sure, as that was quite public, and some of the others seem sold, as the companies seem a bit fly-by-night (of course that may also mean they're clueless about security). One reputable-seeming one I contacted about it claimed they hadn't had a data breach, which I think probably just means they weren't aware of it. I've also had an address scraped and then copied manually from a classified ad - they left out the first letter when they copied and pasted, but I still get it since I have a catch-all!