This is why, whenever I have to provide an email address to a company I don't absolutely trust 100% (and that's most of them!), I provide them a unique alias.
It only takes a minute to set up, say, 'chinesepcbcompany @ andysdomain.com', and have it forward to my personal inbox, but now I have a way to uniquely identify any email which I receive as a result of having provided an address to that one particular company.
If they send me spam themselves, or sell my details, or are hacked, then I know straight away who is responsible, and I can switch the spam off simply by deactivating the address again.
Some companies hate it when I do this because they know just how accountable it makes them, but that's OK. A request to do business != a request to be added to their mailing list and that of their 'carefully selected partners'.