Just webmail or more insecurities?

The address I am getting spammed on is the one I used to sign up to PlusNet's services.

It is not in a PlusNet hosted domain and if I have ever used PlusNet's webmail service it would not have been to check mail delivered to this address.

I have never used the address for anything else.

If a flaw in the webmail system allowed access to this address why not all the other data I used when signing up?