Every time someone clicks "report spam" in their email program, it gets logged, and with enough flags, and IP gets banned. Sometimes the lifetime of a spam server is just an hour or two (not worth registering). This is why so many Amazon EC2 IPs are banned. They are so easy to spin up and spam, then terminate.

The spammers can use "clean" websites as relays to send spam, and move on to a new one, leaving the site owner to deal with the consequences. Likewise, they can send out spam using hacked individual accounts. The advantage here is that people are more likely to open an email from someone on their contact list, and these emails are often whitelisted.