I wouldn't put it past them. Years ago this would surprise me, but not anymore. Like many people, I use 1 junk address for installing software, etc., but then it's hard to tell if 1 company is a culprit. That was a good test you did, so now you know. Yes it's possible that there's some small malware on your computer that monitors your keystrokes or Internet traffic, but it's equally as possible that Avast really does sell the address list, or that their servers have malware on them.
If Avast does it intentionally, then of course they're not going to tell you, but hopefully they'll at least check their servers for any malware.