check your 'My Controls'-> Email settings, to see if 'Send a notification email when I receive a new private message' is ticked, if so then remove the tick
the spammer doesn't have your address, its just a setting that can be turned on or off by each user, if the setting is ticked then an email will be sent to the addy you registered when you joined as a member, the spam bot can't see this email address, its just sent because the setting says so.