Possible Work-Around for Spotlight Privacy/Security bug of Indexing Spam Email
See Spotlight Builds in a Feature Spammers Could Only Dream About.
Excluding Junk.mbox (Apple Mail junk mailbox) and Spam.mbox (my favorite spam filter, SpamSieve) might possibly preclude the Spotlight indexing of spammer mail (it’s unclear when exactly the indexing occurs and/or whether it might vary).
See How to Exclude Items from Spotlight Search. The mailboxes are found inside your Mail folder (inside the user home folder). Look around for each account and you will find them. Drag these into the Privacy tab.