I receive spam (not marketing crap, but pump-and-dump penny stock fraud spam) at an email address I created only for use at TD. Either they sold their email database to spammers, or they got hacked and failed to disclose it.