If the email address is written out on a website, the "spambot" software will trawl on it and pick it up to add-on the lists. USENET, alt. and yahoo/google groups is the most known area for this to happen actively. Some spam is generated through attacks on mail servers and the absolute brute force method is when spam software sends spam to every possible combination of letters at a domain or common words.
Replying to unknown email addresses, all dating, financial, marketing, jobs, health, pornographic site etc membership or request will obviously get you nothing but spam.
I have email addresses that I use online, only to register and fill out forms and they receive endless spam- like 800 total a day. The ones I've never registered anywhere online with receive none whatsoever and all accounts are more than 4 years old.
The link above should explain most aspects of spam more than anyone can in a post.