The image in the article gives the clue: http://sophosnews.files.wordpress.com/2011/01/porembski.jpg http://sophosnews.files.wordpress.com/2011/01/porembski.jpg

The image in the article gives the clue: http://sophosnews.files.wordpress.com/2011/01/porembski.jpg http://sophosnews.files.wordpress.com/2011/01/porembski.jpg Probably an initial small-scale phishing attack from fake accounts, then as others fall victim, use their credentials to spam all their friends. Rinse and repeat.