The Metamask spamming campaign primarily use their own list -- compromised credentials are mainly used to get SMTP access and then spam away until they get caught.