They use dict attacking schemes or brute force, to guess passwords of other email accounts on external submission servers or SMTPS servers (465/587). Sometimes, the bots do have a copy of a compromised Email/Password database, and as many have the same password to their Email account as to many forum/site accounts, they can easily find out which mail server it is to that provider (in the same way that cell phones can autofill the server fields when you have inputted your email, theres lists on the internet which servers that should be used for a specific email adress), and then just try the password from the compromised database.
After that is done, many servers rarely enforce that MAIL FROM matches the user account. Some servers do, including the largest email providers, but many smaller don't because they trust their users. This causes spambots to be able to boast out spam using compromised accounts to, say "hidden open relays".
Theres 2 solutions that you as a ISP can do to leverage the issue:
Solution 1:
If you run a network and want to solve this problem, you can easily block outgoing traffic for 25, 465 and 587, and enforce the usage of your own mail service.
To avoid the problem that users can fetch mail but not send, and get confused, you can also block 110, 143, 993 and 995, that also prevents fetching mail from outside providers. But that is not mandatory to solve the spam problem.
Then you ask the user to use your mail service. This also gives a great opportunity to charge a small monthly fee for the mailservice. (But not too high so users resort to anonymous VPN services and bypasses, make sure its cheaper to use your mail service than bypassing the restriction)
Solution 2:
Another thing, that is common among smaller ISPs is to enforce their server as proxy.
This works, that if I have a gmail account with the following details:
User = Someuser@gmail.com Pass = Somepass
And have a ISP account of:
User = isp856385 Pass = jdshgk
I will need to set up the following in my mail software:
Server: submission.myisp.com
Username: isp856385:Someuser@gmail.com:smtp.gmail.com
Password: jdshgk:Somepass:587
Provide clear documentation on this. Best idea is to provide a easy step-by-step paper when signing up for the ISP account, how email should be configured. You can even have a config wizard on your site, where user can logon with their ISP account, and fill in their external provider account, and then it will tell them how they should configure their account inside mail software.
Then you can apply your normal rate-limiting and spam filtering rules to external providers as well. The same is not needed for IMAP/POP3, because here the user has the possibility to use external services without problems.
Note that if you use this way, avoid restricting the submission server to be reachable from the outside. A good idea is to restrict the first login ever to be made inside the network (to avoid the server being used as a attack platform for compromised inactive ISP accounts to send mail), but once account is "activated", allow from any IP adress, perhaps with country restriction to only allow from the local country.
The reason for this is that people normally roam from Wifi to mobile network with their cell phones, and isn't always using same operator on mobile and wifi, thus to avoid issues when they not are on your network, allow the "SMTP proxy" to be used from outside too. (as long as they have a "activated" ISP account)
