I had made a twitter account a long while ago but didn't really use it. A month or two ago I decided I wanted to start using it again but I had somehow started following 2000 people. I couldn't find a 3rd party app for unfollowing that didn't have me sign up for something so I used document.getElementByClassName(unfollowButtonString) to click all the unfollow buttons at once. Regardless of that hassle, finding and using inactive accounts is probably pretty easy for the people selling these follows. I imagine they just try passwords leaked from other services or applications or hire people to make fake accounts.