It would be interesting to also look at harvesting from PGP keys which have been posted to keyservers. I'm sure that's a small portion of the population, but I wonder if it is being (ab)used.