Unfortunately, spammers aren't stupid. The automated spam processes will guess usernames and see what happens. If the username is used by anybody on any system, or happens to be generated by their algorithms, you'll get spammed.
You could do something clever like use a random password generate to generate a 12-character alphanumeric string that becomes the username with another one for the password but then it simply becomes too much work to keep track of it all.
I rely on my spam blockers. I see false positives and false negatives but I accept (with grumbling) the good with the bad.