mytreo.net hacked or selling email addresses?

So just about every website/company I do business with that requires an email address, I use a unique email address. The email address takes a very simple form: <company name>@synfin.net. The most important rules is that these email address are never used anywhere. So when I noticed I started getting spam to the email address for www.mytreo.net (no I still won’t post it so that spam harvesters can get it, but you can probably guess what it is), it would appear one of two things have happend:

1. The people behind www.mytreo.net sold my email address to someone and at some point it was given/sold to a spammer
2. Someone hacked the www.mytreo.net servers and dumped all the email addresses for all the registered users

If someone has a 3rd idea why, I’d love to hear it.