They are usually hosted by malware installed on a vulnerable system. And if they are SOCKS proxies (vs http proxies), then they can send send spam using the IP address of the infected device.

Cyberattacks use open proxies to amplify the attack/hide their source.