said by stanley_qaz :

Too complicated for spammers to easily set something like this up. They're looking for a quick and dirty solution.

said by state :

I think you oopsed the quotes there, looks like that one came from state.

Spammers like quick and dirty but considering the big bucks to be made in sending spam they are willing to spend some major money getting the code they need written. Trying to mickey mouse a simple fix isn't going to work long term.

However, regardless of the port used the ISP must implement some form of access restriction. Most good ISPs require a user name and password to access their outgoing mail server. This does two things, first a spammer or spam program must find and use your userid and password to send mail through their server, second any message sent can be traced back to the user that sent it directly by account name instead of having to track them back by IP. Since the mail server tracks by userid it is simple to have it drop access for a userid that is spamming and send the user a message telling them why their mail sending was shut down. It could be done by IP but not as cleanly and with worse side effects.

Middling good ISPs implement something like POP before SMTP that only lets you send mail within a short window after you check it. That really is a pain in the behind!

A Joe job does not need to originate from your ISP, it can be sent from anywhere there is access to an SMTP server.

Any security policy that allows the use of Windows to connect to the Internet isn't a "security" policy, its just a policy that gives you a warm fuzzy feeling until you get infested.