A lot of it is luck. You can go years not seeing much of the really malicious spam and then one day you're on the list and you'll find yourself being bombarded

A lot of it is luck. You can go years not seeing much of the really malicious spam and then one day you're on the list and you'll find yourself being bombarded with stuff Spamassassin doesn't touch. Especially if your organization is a potential financial target.