I get about four or five of these incidents a month.
That's why I ended up only doing business only with Tesco and Amazon. Pretty much every other retailer ended up leaking the email address I'd given them(*). It seems (strange/sad to say perhaps) that only the really big boys can keep personal information safe.
(*)The worst offender is LinkedIn. I've configured four addresses for them now and have given up completely. Seems like it only take a month for spam to start coming in to any address I give them.