When people steal someones mail account, they can use that account to send from. That is visible in the bounces you get back.

But much of the spam is just using faked sender addresses. The IP numbers of the original machines are from all over the world.

The bothersome part is that even some real ISP are so lacking in skills that they can't read the IP numbers in the mail headers and figure out what is fake and what is real. So some ISP do block the email address, instead of blocking the sending IP. Pure skill... Should be a web page somewhere, that people could use to register unskilled ISPs.