Spammers harvest addresses for two reasons. The most important is to generate targets. A secondary use is to fake the From address.
A couple of days ago, a spammer sent out a message with my address as the From. As a result, I’ve been getting bombarded with email from spam filters, mailer-daemons, and so forth. So far I’ve received at least 300 such messages. For perfectly good reasons, these don’t get flagged as spam.
This last happened to me about 4 years ago. Back then, I got a few vacation-daemon replies, a few angry human-generated replies, and not much else; it was all over in 24 hours. What I’ve noticed this time around is the wide variety of software-generated responses, and the way that the responses just keep coming. In part, of course, this reflects the diffeent responses from MTA and MUA based spam detectors. However I’m also seeing patterns that suggest that many people must be using mail services with really long latencies. A “mailbox over quota” three days after the event suggests that normal deliveries to that user are likely to be equally slow. Odd.