I'd believe it. For what it's worth, something like 80% - 90% of all email is spam. It's usually better to leave it there and cordon it off so that real users don't notice it. Spammers don't get feedback that their spam isn't being shown to real users.

Also 350,000 accounts is hardly "massive" as the clickbait title suggests. No way that can account for more than a small percentage of traffic.