This is the behavior I have observed too. There are addresses that could not plausibly be gotten by any means other than unauthorized scraping of my mail or contacts.
The only other mechanism I can think of is that maybe they're getting them via Android or iPhone apps (not necessarily linkedin's app) with less-than-upfront disclosure of what the app's doing. Either way, it's slimy behavior.
No idea how they've gotten access to that, but I've never knowingly authorized a connection to my address books.