I have received two unsolicited advertisements to an address that has never been given to anyone except Stack Exchange (SE), and they are not from SE. The address hasn't even been used to log into SE because all the conflicting instructions I've found for making the change refer to links or buttons that no longer exist.
I'm asking about what can be done in terms of SE, not a general response to spam. (I know about detection and filtering methods and ways to report, etc.) I won't be surprised if the answer is "nothing", but it "doesn't hurt to ask."