Can cookies reveal my email address?

Unless the spam is coming from the site you're visiting or that site already knows your email address, it's unlikely that site is to blame. In fact, unless you've associated your email address with some service that is a partner of the site you're visiting, there's no way for them to even get your address (i.e. whom did you actually tell your address to?).

Instead, a more likely scenario is a local compromise within your browser or otherwise on your machine or local network. Software running locally could scrape your address from forms you've filled out, and then could watch your activity no matter where you go or what you do -- no VPN or encryption or anonymizing service can offer any sort of protection if the attacker controls your computer.

Many people unwittingly install browser extensions; toolbars, "safe search" extensions, or other helpers as part of other software installs. The less scrupulous the software's distributor, the more likely these things get bundled in. Any such software could easily do this and much much worse.

Likewise, such software can be installed by infected websites using such vulnerabilities as the Adobe Flash zero-day vulnerability patched yesterday for Windows, OSX, and Linux. If you have Flash installed (and you likely do), then your browser was and probably still is vulnerable and being actively exploited by malicious websites.

They are always finding new and innovative ways to track your online. Web analytics companies make good money by scraping your data, making profiles of you by tracking your habits, and selling that information to 3rd parties without your consent.

It takes being proactive to protect your identity online. Sites use cookies (flash/html) as part of their system, but that is only part of the story, which is constantly changing.

Some good toolbars to use to help keep your habits safe are:

• AdBlock
• FlashBlock
• Disconnect.me

That is a start but by all means not all you can do or even should do to protect your privacy. You would be amazed by the amount of time/money invested by companies for harvesting your data :)