Either (a) a leak, or, more likely and more common (b) a dictionary attack
(b) being simple in concept, the culprits have a list, generally of real words (hence "dictionary") supplemented by common human names and other common made up words.
Take one dictionary list, one bot script and hey presto, a spam campaign.
