There are massive databases that track people and a subsets of those that track students and alumni. I wouldn't say that the NSLC is the only source of data. Almost every large school and community college has a bank with a branch on campus promoted through the school and they will sell your information and data. When you graduate and leave school you usually get on an alumni list that in turn feeds other sources, and so on, and so on. State and federal agencies also get data feeds from colleges (other than NSLC). If your college uses a service to clean up names and addresses, well guess who now has a name, address and part of a social security number in some cases? Yup, that organization and the database they use/feed, and the database its uses/feeds, all the way up to the big database. Guess who also uses the big database; mass marketers.
The point is, once your name gets in a list then the spam will come and mass marketing will come. And that list never gets updated with info like you graduated, or dropped out, etc.; you're just a name and they will continue to spam you even if you've moved, got a jobs, paid your loans or even died in a car crash.
I'm not advocating any of this but it is simple a fact. Once you are a student there are a number of ways you can end up on a list and many of them are uncontrolled and some the college in question is legally required to use/feed.
Oh and the only way to get rid of a social security number as a means of identification is to provide a better universal ID. Seriously.