Did Home Depot sell my email address?

Check out the screen capture to the right of this post. A piece of SPAM showed up in my SPAM folder today and when I took a closer look at it, it was sent to homdepot at haggaret dot com. The only place I would have used that address would have been to sign into the Home Depot webpage, and I don't think it is supposed to be publicly visible. To me that means that they must have sold my email address. Not cool at all.

BTW, I do this for nearly all website where they ask for an email address. Makes it easy to filter incoming mail and also to find out if they are doing stuff like selling your address...