Guessing and trying?
That would require tens of thousands or even millions of bounces for every
successful mailing attempt. I don't think anyone is doing it that way.
Online directory provided by her email provider?
Which e-mail providers are providing online directories? And how many of
these directories allow you to extract addresses without specifying any
search parameters (such as a name)?
Not understanding risks, she joins a seniors mail list?
Possible, but not likely.
Someone she corresponds with blasts an email to
a bunch of folks leaving all addresses exposed,
and one of the addressees does some action which
exposes the email to a spammer's harvesting process?
This is getting more and more farfetched.
Or more explicitly, someone she knows copies her
in a post to a mailing list which is being harvested.
A list to which she doesn't belong? Again, this seems unlikely.
The point being that it isn't difficult to end up
in the spammer's email address lists.
I have quite a few addresses that remain untouched. Only the ones for which
an obvious harvesting path exists have received spam.