There is a kind of spambot that I call a Sleeper. It poses as a legitimate account by “stealing” arbitrary tweets from the public timeline and tweeting them as its own. As it follows people, a proportion will follow back. Eventually this account will have built a mature following and can “wake up”. i.e. it can start tweeting its cargo and even send DMs.
These bots are usually easy to spot because their tweets all show as being “From API”, meaning that the update wasn’t sent by a registered app using OAuth. If I was a spammer, I’d be wanting to fix that because it’s a dead give away. I’ve also seen other services such as HelloTxt being used by these bots, but just now I spotted something new. – Tweets from Tweetie.