However the scammers would have to be able to capture email addresses from the website, somehow. My browser does say this site is “not secure” but I don’t have a clue as to what that means with regards to stealing info like email addresses.

Way back at the beginning of internet time, I recall that a persons email could be compromised in such a way that their entire address book could be copied. It may be that a bead person somewhere has had their address book copied and the result is every other bead person they know is getting scammer emails from the list that has probably been sold multiple times by now.