DotNetNuke has never sold any customer information.  The problem you are experiencing is not something that is uncommon.  I have had accounts at numerous locations and even my unused accounts will eventually fill with Spam.  It is not hard for a spammer to get email addresses - the following snippet was posted in a Microsoft newsgroup back in 2003.  I can only imagine that spammers have gotten more sophisticated since then.

Massive lists of live emails are collated and circulated between
spammers, random name generators are used.  The spammers don't care about
the inevitable failures when using generators - the return address for
bounced message is either fake, or the real address of an innocent
bystander.

Some spammers run automated processes using Telnet etc to probe MSN's
servers day and night to record exactly what kind of error message an
attempted email send receives, because standard rejection messages allow
the spammers see the difference between working addresses and dead ones
(a "dictionary attack").  As quick as the probes are detected and
blocked, they switch to another ISP/IP and keep going.  The bandwidth
these spammers suck up is absolutely unbelievable - as broadband and
cable access has become more and more widespread, it has become easier
and easier for spammers to increase their send loads.

Hotmail, MSN, AOL, Earthlink and Mindspring are the top targets for
spammers, who use random name generators and all sorts of wonderful
tricks to create email addresses in the millions.  They don't care how
many of them bounce; they use open server relays illicitly to send their
wares, and the return address are nearly always spoofed so they don't get
any bounces.  Often the emails are HTML based, with embedded graphics
included that must be fetched from a remote server to display, thereby
proving than an email has been opened.

---

Joe Brinkman
DNN Corp.

As Joe mentioned I would agree that it is an external source. 

I have accounts that are isolated an NEVER used, yet they still get spam, so you don't have to give out an address to start getting spam

---

-Mitchel Sellers
Microsoft MVP, ASPInsider, DNN MVP
CEO/Director of Development - IowaComputerGurus Inc.


Visit mitchelsellers.com for my mostly DNN Blog and support forum.

Visit IowaComputerGurus.com for free DNN Modules, DNN Performance Tips, DNN Consulting Quotes, and DNN Technical Support Services