- Spammer sends stock spam with 'somefakeaddress@someoneelsesdomain' in the 'From:' line
- One such spam (perhaps sent to a mailing list) is archived on a web page somewhere.
- Spammer's web-crawling robot crawls the page and sees the mail address.
- Spammer sends stock spam to 'somefakeaddress@someoneelsesdomain'.
This is not just a theoretical possibility. I've just seen it happen. The real irony is that it looks as if the crawler belonged to the same spammer who sent out the original message. In other words, the spammer is spamming non-existent addresses that he invented himself.