i would guess the easiest way for this to be happening is that there is an "information stealing trojan" attached to one of the routers along the way, this trojan would sit there collecting the addresses of the e-mails passing through that router, then relay that info to the spammer, who then sends you a spam mail, an explanation for the secondary spam that follows could be that that spammer also sells the addresses he collects to another spammer, i would guess that the whole process is automatic aswell, that the spammer doesn't actually have to do anything, spam is probally automatically sent, when a set number of addresses have been harvested.