..

I am absolutely unastounded.  Determining who is doing it
is the first problem though.

Perhaps you should use a series of addresses and only use
one for every half dozen progams you download - that would
help narrow it down.

BTW - what is the specific connection with Java?

Sometimes this may be due to desktop email-borne worms that use local
harvested email addresses not only for delivery but for obfuscating the
sender.  By this process, private correspondent email addresses can be
leaked onto the Internet.

More likely are the companies that sell their list of customers to
"affiliates" for advertising who either turn out to be spammers or the
ones that sell them to spammers.

This is one of the reasons to hand out tagged email addresses.  For
instance with sendmail-based mail servers and others (including Gmail,
apparently), you can use an address like this:

    localpart+tag@example.com

that will deliver to

    localpart@example.com

and allow you to see where the address came from.  For instance, if you
end up getting spam from localpart+amazon.com@example.com, and you only
gave that address to amazon.com, you know where the leak occurred.

Similar things can be done with sneakemail or mailinator with unique,
obuscated local addresses that are easy to track back to the source and
difficult to convert into an untagged address.