This is not entirely true. A very large percentage of spam (70-90%) is stopped at or before the banner, at a layer he probably doesn't control (unless he runs his entire email infrastructure).
I do run my entire email infrastructure, in this case. During the time period where a lot of these spam messages were received, it was directly hosted on a enterprise fiber line, on its own IP address, which I wouldn't imagine was doing any sort of filtering.
I could be wrong and it's possible that some filtering was happening on the ISPs side, but you'd think that of the thousands of spams that get through, there would be some that looked like guesses.
If someone was just trying things to see what worked he would see those emails.