I have a different explanation for the hexadecimal addresses.

I get maybe 30 a day, from numerous sources, and they actually turn out to be legitimate message-IDs which were generated by my host when replying to public mailing-lists.

I think some kind of automated spider decided they were mail addresses.