Newbury,
Not certain what you mean by usernames used by spammers. The spam senders cycle through forged ("spoofed") outbound email addresses routinely and more recently have been doing this for one single spam blast, from up to 100k different server addresses/compromised systems (google "Dridex" malware). That is so message failures go elsewhere, and so the message appears to be from an actual person. They also can/do reuse spoofed outbound "from" addresses whenever needed, but typically for very short periods. If you have ever seen a bunch of message failure notices for messages you never sent, that's likely what occurred.
They will also send spam to recipient addresses repeatedly over time, explaining the junk we all receive. Lists are bought, sold and obtained directly from hacked/compromised systems. Also, once an email address is publicly available on the web it's a certainty someone will send to it, and will forge/spoof it as a bogus return address on outbound spam.
Hope it helps,
Dan
