That squares with what I'm seeing, yeah - a lot of cheaply automated nonsense trolling for a few suckers.

Is there anywhere I can look for more information on how this model works in detail, and how to avoid the same problem in future? It's a real pain in the neck. Thanks!

Best way is to opt for whois protection in your first year or for first few months. Here is a mail I received offering the service.

Hello,

My Name is Prk Aa

We are providing whois data in very low price

Daily more than 100,000 domains are registered

Reply Me with your contact number & skype id.

Warm Regards Prk Aa

Lessons learned, I suppose...

Except it's not new at all. Since I first got my email on my primary domain in 2008 or so I've had admin@, postmaster@ etc., Along with the address in whois all being spammed.