I knew a System Administrator who use to have contact with the spam circles and they have teams of programmers dedicated to finding new ways to get these things on to your computer.
Seriously.
Clusters of computers operating on a bank of a few hundred IPs sending spam so if one IP gets blocked... who cares?
Scary part: it works.
They get maybe a .5% hit/purchase rate. So 5,000 sales on 1,000,000 popups or items of spam mail with nothing but the setup cost of the computers. They honestly think the public wants these ads (because they do get sales) and so only try to reach a larger and larger "market".
*shiver*