My dad has already changed his address once.
Best practice: prevention.
How bad can spam get?
The Jeff7.com domain received 555MB of mail traffic in the past 30 days. A few months ago, it got a rash of nearly 4GB in just 3 weeks. I don't know if there was a worm going around or what.
At any rate, I have a catchall set up - if e-mail doesn't go to a legitimate username at my domain, the catchall gets it. And then it deletes it. Hundreds of messages a day, probably into the thousands even, many of them are duplicates.
Now, prevention:
If your e-mail address is visible to a person, it's visible to crawler programs that scour the Internet looking for e-mail addresses. Don't leave your e-mail address visible. If you want to post it online, use an image - I have an image on my website with the address on it, with a wavy background on it (in the event that spammers ever put image recognition software to use). And if you code a webpage, and the coding has a mailto: tag in it, with your address, it's visible to the crawlers.
One other possible way of getting yourself on spam lists - if a website with some cute/stupid animation, or something like that, has a link on the page that says "Send this page to someone you know," when you type in that e-mail address, you might be giving that address to spammers. So make try to make sure that no one sends you links that way. If they want to send you links, have them do it manually, by copying and pasting the address into the e-mail program.