University Email Spam

When I graduated with my B.S. years ago, I signed up for my university to forward my email from the account I had with them to a different account.  Now that account is filling up with spam that's coming through my old university email.  I remember a few years back receiving a letter that the email system was hacked, so that could be how the spammers got the address.  However, I'm wondering if the university is so cash strapped they sold addresses to spammers.