These are the accounts of legit senders being coopted to send very targeted spam. I don't think you can distinguish it by volume, because the volume needed to

These are the accounts of legit senders being coopted to send very targeted spam. I don't think you can distinguish it by volume, because the volume needed to make these schemes work is just a fraction of the basically-legitimate volume these services process. The real bulk bulk spam is a different issue entirely.