Lists...

“In several cases, the hacker imported their own lists, and managed to send spam to those lists and in some cases the lists already in the account.”