A TheReg article confirms what we've all suspected (if not known for sure) for some time: viruses "call home" from infected PC's, and the writers - or the managers of the trojan network thus created - give or sell the addresses of the drones to spammers.