Most often, this is because users have typed their email address into the web site! We have a strict policy against giving out company email addresses to non-work related 3rd parties.
Regardless, we get tons of spam anyway. Even legitimate business partners can go bad on you. I had a paid subscription to X-Drive and used my email corporate address to set up the account. The X-Drive was used to exchange large files with a client. I used the clients name when setting up the X-Drive account. When X-Drive went under, they sold their email list to spammers and I started getting spam sent to my corporate email with the greeting, "Dear clientname"!
If your users have stored profile information in IE, websites can request that information without user intervention. In IE6, this needs to be manually setup by the user before it can be used. Check out tools, options, content, my profile.
Good Luck,
John