From finger daemons. Spammers use this information to get extensive users list from hosts, and of active accounts - ones which are 'live' and will read their mail soon enough to be really attractive spam targets. Spammers harvest AOL names from user profiles lists, as it allows them to 'target' their mailing lists. Also, AOL has a name being the choice ISP of newbies, who might not know how to recognize scams or know how to handle spam. From domain contact points.
Every domain has one to three contact points - administration, technical, and billing.
The contact point includes the email address of the contact person. This is a tempting methods for spammers, as those email addresses are most usually valid and mail sent to it is being read regularily. Then they wait for either an error message to return by email, indicating that the email address is correct, or for a confirmation. No news are, of coures, good news for the spammer. Also, some email addresses are standard - postmaster is mandated by the RFCs for internet mail.