Why not register a custom domain name and then sign up for the free version of google apps for email management.
You then have the benefits of the gmail spam filter with the protection of a spam-bot "resistant" email address because it isn't generic.
I have an account only used for job applications I have handled this way. I don't receive any spam on it because it isn't posted anywhere but my resume and no bots are spamming random email addresses at my domain.
Also, if the child is that young, I'm also of the frame of mind that you should be keeping an eye on their activity any way.
