As Roberdin mentioned, many people actually contribute to the spamming without even knowing it. I must admit, the ingenuity used by these guys can be impressive.Denyer wrote: Getting people to do it is significantly more expensive and time-consuming than leaving a single machine or botnet to attack verification procedures.
Lets say a brand new captcha algorithm is released, it may take weeks to months (for example's sake) for them to write an ocr script capable of bypassing it.
Now, at any point in time there's millions of people searching / browsing for free porn on the net. So this is how the procedure works.
(1) Random guy visits free porn site
(2) Somewhere else, a forum spambot encounters not-yet-bypassable captcha on a forum
(3) Spambot grabs the captcha image from the forum, and passes it to a script on the free porn site
(4) The script displays the captcha for the random guy on the free porn site, stating he needs to complete it for access
(5) Random guy fills in the captcha, the script sends the text back to spambot
(6) Spambot fills in the not-yet-bypassable captcha on the forum, and successfully bypasses it
(7) Forum is spammed.
Theres always millions of people searching for free porn on the net, at any point in time. There will always be a human available somewhere who can be fooled into doing things without them even knowing they are doing it, like helping spamming.
No doubt about it, the ingenuity in these techniques can be amazing.