This can be difficult to resolve because you don't see the smoking gun -- the "login".
What happens in some cases (such as yours, from the look of it) is that there is one login, ages ago, which the spammers then use to send spam in quantity as opposed to them logging in to send each...