My name is Karine Kong, Director from www.wheredidyoubuythat.comI must say that this sounds 100% plausible. It looks as if the email addresses have been harvested off an infected machine.
First of all, please accept our sincere apologies for the inconvenience you are experiencing.
Unfortunately we have never received your email mentionning this spam issue, otherwise we would have responded to you within 48 hours. However, now we are aware of it, our technical team is looking into this to see how & why this is happening.
I would like to reassure you that for security reasons, our database does not hold customers card details so even if some malicious virus have broken into our database, there is little they could do except annoying our customers with spam emails. I shall let you know how this is resolved as soon as possible. In the meantime, do not hesitate to contact me if you have any queries.
Incidentally, wheredidyoubuythat.com does have some really nice stuff :)