The article isn't clear, but I'm not sure the study equates email and spam. Maybe there really *was* spamming going on. Should be easy to detect: if the unauthorized user sends a few messages, it's probably not spam. If they send hundreds or thousands of identical ones, it probably is.

Spammers jump on every technology and loophole they can, so why assume they wouldn't wardrive to find an open WiFi link to send spam from?