If your email address is out there you will be spammed. Don't be fooled though, generating SHA-1 hashes for 100 million email addresses is going to require a non-trivial amount of compute time. Add to that the overhead of setting up and maintaining a db to associate the 'cracked' emails with demographic info and now your talking real infrastructure.

The biggest problem I see is what value is there to a spammer to being able to associate email addresses with social network identities? Spammers don't target their missives because there's no incremental cost associated with sending another email.

Not leaving your email address in the clear in FOAF is better than the alternative. The question ends up being does FOAF add enough to make the cost acceptable. Clearly I vote yes. The risk is basically 0 and the benefit is you get to float around the "social internet" with your friends.