This is the behavior I have observed too. There are addresses that could not plausibly be gotten by any means other than unauthorized scraping of my mail or contacts.

The only other mechanism I can think of is that maybe they're getting them via Android or iPhone apps (not necessarily linkedin's app) with less-than-upfront disclosure of what the app's doing. Either way, it's slimy behavior.