This has been going on for a some time. I"m on my 4th email address at Ameritrade. The first was purloined some time before 11/21/2005. At the time, they wrote back:
"Ameritrade has received reports of clients receiving spam at e-mail addresses that were only provided to Ameritrade. We are currently investigating this situation in order to put a stop to it as soon as possible...."
The next email address was pilfered by late July 2006, and then another between late August and early October 2006.