Is it too big a leap for me to assume someone is going around using password spraying or whatever to compromise neglected accounts for use as spam bots?