On a new website, I publicly display an email address, [email protected]. Then I set up an email forwarder in my hostmonster cPanel, so that if the public email address ever became spam ridden then we can chop off the forwarding.

However, the client received a spam message that looked like the following.

To: client's personal email address (not the public address)
Subject: domain.com opportunities
Body: marketing junk

The problem is that the "to" should have said [email protected]. I am now worried that the real email address was retrieved on the backend of hostmonster.