Turn off and completely disable any feature related to return receipts and auto-responders.  These do more to confirm your address to spammers than anything else.  Out-of-the-office and vacation responders included, these tend to provide virtually nothing of concrete value to any real sender, while advertising yourself to the junk mail world...it's as good as an opt-in invitation to bury you in junk mail because the spammers then have what they interpret as a solicitation for more from you.  If you feel you just have to tell people that you are out for a few days, have your mail forwarded to a co-worker who can either handle the senders message or send a quick note back that you'll respond when you return.  In the event of a planned absence, you and your correspondents are better served by sending them a broadcast email in advance so they can plan to work around that schedule.

Do not allow your email address to be published on any website, especially your own, but also anywhere else if it can be avoided.  Club affiliations, recognition or interview articles that may be published, etc. all may have member listings including email addresses, and while the narrow intent is for other members to connect with each other, the broader effect is that spammers frequently employ website "spiders" that crawl over web pages looking for anything that even remotely resembles an email address and will harvest them mechanically right into a database.  The exception of course is pages that are behind some form of password security that a spider can't get past.

Firmly advise everyone you know that has your email address not to ever give it out or type it into any website for you.  Tell them that those all-too-handy email-a-friend boxes seen all over the internet are harvesters for spammers and should never be used.  The same is true for websites that offer freebies or member upgrades or other benefits if you just Invite-A-Friend to visit or join or sign up.  There is no free lunch, and you can bet that if they're giving all this stuff away they're getting something in return someplace, and pushing spam and selling email addresses is the "back-end" money.  Say "NO" to e-greetings and other greeting card websites - these are especially notorious for this practice.  If you care that much send a personal email direct to the intended recipient...they may appreciate that even more.

When shopping online, have a throw-away email account handy and use that instead of your real address.  These are readily available from numerous places, including Hotmail, Yahoo, and the like.  If your ISP offers unlimited Aliases, take advantage of that and give those out - you can always turn them off when the junk starts rolling in, while retaining the security of your real address.

When viewing email in any mail client program (Outlook, Outlook Express, etc.) or webmail (browser based) screen, always turn off the preview feature until you've deleted the junk and are certain that the messages you're about to open are what they appear to be.  HTML formatted email messages can contain images or other externally linked resource tags that call up content from the internet on-the-fly when they are viewed.  While this is very handy in that it keeps the message size smaller, the resource links to those elements often include unique identifiers that report back to the sender exactly who viewed the message, thus confirming the validity of your address.

Always make sure that your email client has the security settings adjusted to the highest possible, as this will prevent embedded scripts and "ActiveX" content from functioning without warning.  Such content operating from inside your mail client may execute in a "trusted" mode, and therefore can do a lot more harm.

Never open any file attached to a message that you might even remotely have any doubts about.  If it's unexpected from what appears to be someone you know, contact them first and make sure they really sent it.  Keep virus signatures up to date DAILY.  If the message is not from a recognized sender, you're better off just deleting it than allowing your curiosity to prevail.  Remember that once infected you can't just "undo" it.  You'll have to find some cleaning tool to get rid of it, and depending on the virus, important data could be lost, or your computer could be rendered worthless.  Even the mildest of viruses will drain your address book and transmit the contents out to some collection service, and suddenly you've not only exposed yourself, but everyone else you know as well.

Invest $40 in a decent software firewall.  In a few days you'll have it tuned to your usage patterns and it will go a long way to protecting your system from outside prying eyes AND if you do happen to get a virus many of them will also contain the damage to just your computer, instead of broadcasting the virus or spam that is generated by it.  Do not expect that your ISP can or will protect you exhaustively.  You'll be amazed to discover how much of the software you already own regularly "phones home" to the vendor and there's no real telling what information is being sent out to them.  Do a Google search for Spyware and Spamware and you'll get an idea of some of what's going on under your nose.  EZ-Armour is an excellent easy-to-use product that virtually anyone can master in minutes, and includes a world-class antivirus product in the package