Have gotten multiple such emails the last couple of weeks.

I think Googles spam detection is a bit too much lax when the sender itself is using gmail.

These might as well be hacked accounts which have already proven themselves to be valid and "human" at a previous point in time? I doubt gmails spam detection would let a brand new account spam CC'd emails without any sort of detection.