If all the spam came from a tiny set of hosts this would for sure be true. This for sure used to be the case. These days spam comes from millions of infected PC's and VM's. You will almost never see more than a few dozen connections come from the same host in a day, with exception to rented VM's because they have more resources. Spammers can control how much is sent from which classes of infected hosts. This also applies to the logic in their malware for things like brute forcing ssh/https/mysql connections. The victim rarely notice the malware any more, as it runs at lower CPU priority. Some of the malware is even polite enough to use a single core. Even telling ISP's and VPS providers a host is infected can take weeks or months to get someone to look into it.
