From the perspective of PayPal, it's not that his personal email address is made public. It's that the fact that he has a PayPal account associated with that email address is made public.
It's similar to advice for "forgot password" forms not to acknowledge whether or not an email address or username actually exists--simply tell the user an email was sent for that account regardless.
Fair enough, but it's a reasonable guess that any given primary email address has a paypal account associated with it. It's also not really secret, because you share that information with people to allow them to send you money.
At this point, that's like trying to reduce flooding by not dumping a bucket into the river. There's so much spam out there that your only hope is effective filtering.
Oh, I've still got filtering, but it reduces how good/aggressive my filtering has to be.
It is indeed very difficult to keep ALL your email addresses from being publicly listed, so I use GMail accounts for the ones plastered all over the web, and let GMail handle the spam.
> @troyhunt: It has my email address – I get email by sharing it with people who might want to send me email!
This is golden. Hilariously incompetent tech support trying to make someone delete the tweet complaining about their spam.