In this particular case, it's true. According to Section 7704(b)(1)(A)(i) [0] harvesting emails is considered an aggravated violation of the CAN-SPAM act and is subject to triple the statutory fines per section 7706(2)(f)(3)(C). The normal statutory fines are up to $250 per violation per section 7706(2)(f)(3)(A). Doing the math, 28000 * $250 is $7,000,000.

Fortunately, according to 7706(2)(f)(3)(B) this is capped at $2,000,000. However, this is prior to triple damages taking effect for aggravated violations of section 7704. This means that those 28,000 emails (should one be foolish enough to email them) carry a CAN-SPAM penalty of up to $6,000,000. Or about $214 per email address. I hope it's worth it.

[0] http://uscode.house.gov/download/pls/15C103.txt

But the pro spammers use proxies that make it hard to trace activity back to a person. And many of the people spamming are not in the US.

Very true, but recruiters do use GH to get contact info... It's just easier if you dont have to deal with unsolicited emails.