I would imagine they just buy old accounts on black hat sites and reuse them? Or use leaked login credentials for abandoned accounts.