New Barracuda Networks data shows attackers sent some 3 million emails from around 12,000 pilfered accounts.