savag3: I wonder if the third party email marketing system they have used (mailprimer.com) has been compromised. That might explain why emails used at other companies have been spammed as well.
many of these email marketing companies have their SMTP servers based in the US and in other countries. That means that thousands of emails travel, unencrypted, backwards and forwards over multiple hops through more than one ISP/transit company. Someone with the ability to sniff traffic at any of these points could easily create an email list that contained all the email addresses that belonged to a companys' database. All it takes is an attack on an unpatched router, a dodgy employee at one of the companies controlling one of the networks, a dns spoofing attack, or one of a number of other means. It doesnt necessarily mean a specific companies database has been compromised.