There are indirect scanning techniques that induce and measure traffic from ordinary non-compromised hosts. When the attacker notices that he gets banned for scanning he'll do that.

http://nmap.org/book/idlescan.html but IIRC there are more ways than this to do it.