yea, thing about anonymity and security is there's no 100% guarantee. even with tor like you said earlier, they do use 3rd party applications and you can allow 3rd party applications access (such as youtube), which will can reveal your real IP and computer info.
as for email addresses, since i see lots of people talking about it (not really a reply to any one person):
gmail is actually pretty secure. they run all emails through their server so the headers don't display your information, and they can't reveal that information without a subpoena. you can enable two-step verification which hooks into your phone, meaning that if someone types your password wrong a couple times or sign on from another device, they lock the account until you reactivate it with your phone. they advise you of any logins not from your IP address (outlook is
actually surprisingly good about this too, i use tor when i'm doing my server work and we have an outlook email, and i always lock myself out of my own damn email.)
google isn't perf, as a big company you know they're interested in targeted demographics and advertising. their
privacy policy states that they only share your personally identifiable information with your consent, but non-personally identifiable information can include your date of birth, gender and zip code which can according to this study identify up to
87% of americans.
even so, if you have an email account at all, you run the risk of this happening. any email provider (yahoo, aol, outlook, etc) is going to do this. at the very least, google doesn't pussyfoot around about it. their privacy policy explicitly states all of this. so it's up to you to fill in the rest of those gaps. i use a stupid pseudonym and keep all my location info fake.
as for spam, that doesn't really mean your email or your info is compromised. if your email address
is literally anywhere on the internet,
especially on a page that shows up in google results, bots will trawl that information and send out spam messages. if you enter your email address even into a site to register, if those email addresses are public, bots will trawl them. if the user registration pages aren't protected by robots.txt or password protected, bots will still trawl them.
but for a free email account gmail is your best bet. for the day to day it's extremely secure, and while you can't guarantee what google itself is gonna do, other people aren't going to have access to your info unless you are stupid and give it to them. hushmail is pretty good too, but they're limited-use emails i think.