Hi!
A) From DHCP IPs where one user at an ISP is infected and another isn't. B) From the Spammers themselves purposefully poisoning the list and using it for DoS.
Nope, a IP dont get listed since its inside a mail. Its getting listed once we see evidence, the scrapers take care of that.
Bye, Raymond.