I’m very careful with privacy and security so I was surprised I got an obvious phishing email from “American Express”. I reported the email and moved on only to get another one today. I checked haveibeenpwned and it came back clear. I have never gotten a phishing email before the other day. As for the senders, they all came from generic IT sounding email addresses. They obviously weren’t American Express.
Some companies just blatantly sell your data. Others get breached and you are part of the package that gets sold by the hackers.
The only “way around” is to use unique mail addresses for each signup/company so you can easily lock it and switch to another one when it gets known.
Just assume, that everything that you type in a form online (or in any other way send to a company/another person digitally), every email you send, everything that gets digitized about you, etc. will be public one day. Either because the other side of the transaction sold it or because they (or you) will be hacked eventually.
Btw: HaveIBeenPwned does not necessarily contain all breaches. I have several notifications of companies that got breached and leaked my data that are not listed in HIBP…