Incidentally - PlusNet (who are 100% owned by BT) have a very similar issue ongoing - see http://community.plus.net/forum/index.php/topic,133959.0.html
Symptom: a separate, specific email address set up specifically for setting up a PlusNet account, never used to send, only receive mail - only given to PlusNet - starts to receive spam from non-PlusNet sources... 24 pages of debate, evidence & investigation.
Net Result: despite the obvious inference that there is a leak at PlusNet, PlusNet have denied it and effectively washed their hands. To the man on the Clapham Omnibus, it quacks like a duck, looks like a duck, walks like a duck...