I am the email administrator where I work and over the summer there has been an onslaught of phishing email specifically targeting our Windows Domain credentials. It's probably not a shock when I say that people fall for this and as such we run into times when compromised accounts are used to send spam out through our servers.