Sometimes, spam comes from legitimate, but compromised accounts.
When this happens from Microsoft's, or Google's servers, it's best to report the spam directly to their abuse team, so they can manage the spam directly. Typically, they respond within 24 hours by disabling the mailboxes.
Please report abuse to Google using this web form: https://support.google.com/mail/contact/abuse
report spam, phishing, or abuse from an Outlook/Hotmail/Live account, forward the malicious email (including full headers) to abuse@outlook.com. For specific phishing attempts, you can also forward them to phish@office365.microsoft.com. This allows Microsoft to investigate and take action against the offending account
