1) Lure employees of big companies (especially e-commerce ones) with cash and buy email dumps of their users. I don't think email security was something many companies were vigilant about. 2) Send email campaigns for their clients, which included other e-commerce companies, colleges, and travel agencies.
The business, as I remember, was quite profitable. I can't say if something like this is at work here but there's a healthy black market of buying email lists.