A few years ago, I signed up for a Borders rewards card. Gave them an email address of borders@mydomain.com. Weeks later, began getting tons of spam to that address.

So uh, I'm guessing that this Borders employee isn't the only one who knows about this.