I am tempted to try this test:
Set up an email as a catch-all so that I get anything sent to '*@mydomain.Info". Then post a message on usenet with snipped-for-privacy@mydomain.Info and see if after the '*@mydomain.Info".gets harvested dictionary blasts are used.
[TELECOM Digest Editor's Note: You might very well, and certainly dictionary attacks are common enough, but it is far more likely, IMO, one or more spams within a few minutes of opening the account is more that likely a devious registrar employee who has a deal on the side of his own with some spammer operation. PAT]