I guess that's a risk, however a decent commercial enterprise has a lot to lose by selling email addresses and ruining their reputation.
There are definitely scams out there however:
You are taking a risk *any* time a Joomla extension vendor asks for your admin login. You are taking a risk any time a template vendor works on your system and can view your configuration.php file. You are especially taking a risk any time a developer has access privileges to your database.
Ideally, you would always have internal staff work on your Joomla site but that's not always possible - especially for a very small company or single joomla site owner. I am a FT joomla developer and I manage a small group of contractors. Every now and then I am put in a position where I need to staff up with a freelancer. In those cases, I try to lock down privileges to a specific directory (module, template etc). I also try to hire people who I believe would have more to lose by acting unethically, meaning, they have a real business built up and it wouldn't make sense to risk it over some resold email addresses.
Also, that's why you should always include a few "fake" accounts in your forums if you are concerned that a conversion service might use the email addresses unethically. If those accounts, which should have email addresses that do not appear anywhere else, suddenly start to get spam emails, then you know your data has been compromised by a vendor. Of course, it's a little late if it's after the fact, however, you can still warn others about an unethical vendor and let that vendor know that you've caught them. If everybody did this, it would force some people to reconsider before they engaged in reselling email addresses - they would get caught.
Specifically I can say that Forum Migrations seems to have handled everything ethically. And yes, I do have fake accounts in my converted forum and no, none of them have received spam.