It may well be that, but that doesn't make it okay. They shouldn't be building an email database by scraping, which is almost certainly what happened.

In a vaguely related note: I recently had a situation with an organisation that kept bulk emailing a plug for its conference and would ignore requests to eliminate all addresses using[mydomain].com from their database (they were sending email to aliases as well as actual mailboxes).