I made a new Gmail account about a year ago that I have not used for anything (have not sent any email, or used it to sign up for anything, nor have I given it to anyone for work or general contact), and it started getting spam already. Which means either things are just using random addresses to spam, or Google themselves are sharing it.