I receive SPAM "pretending" to be from people I know. But what I don't know is how the spammers make the connection between myself and the person they are pretending to be.
Consider this: http://imgur.com/a/CSEXL
I know Martha Howlett.
We send e-mails back and forth.
How do the Spammers know to send me spam, addressed from her? How do they make the connection?
Do they have her address book? Did some app suck her contacts up to the cloud?
Does she have spyware?
These are all possible scenarios. It's also possible that someone else, who has both of you in their contacts list, has had their information stolen.
By the way, this kind of spam has been happening since long before apps and clouds, when people had e-mail clients on their PCs and viruses stole their local address books.