If they're using a botnet of compromised servers then I suspect the marginal cost is negligible.