Half the time they literally say it in the email. I just looked in my spam folder and just a few hours ago got an email titled "Your profile: Github", that started with:
> I came across your profile on GitHub. Given you're based in the US, I thought it might be relevant to reach out. > > Profile: https://github.com/tedivm
They aren't doing anything to hide it.
But hold on.
They could have git cloned your repo, used or otherwise analyzed your code which follows TOS then used the local git repo to pull your email address.
How is GitHub responsible here?