I report all the spam that I can track back to the originating service. I received this in response to one such complaint. I don't think it would be fair to post the name of the host (one that already has a bad reputation here, although not a truly awful one), but I thought y'all would be interested in what they said:

This is a server that we suspect has been compromised. We are in the process of investigating this issue to find the compromise. The server is a web server, with approximately 3000 accounts on that single IP address, so please do not null route that IP address. Thank you for your time.

I hardly think they'd want to broadcast the fact that they have that many accounts on a single server, much less on a single IP address! But maybe I'm wrong....

Single IP address != single server. There's a major ISP in the UK (can't remember the name ATM) which has about 100,000 virtual sites on 4 IP addresses: those IP addresses point to a cluster of load balancers, which then pass the requests to a (large) cluster of servers.