One thing I find surprising about the spam I receive is how irregular it is throughout the day. If I’m receiving spam I’m getting a lot of it; then the mail queue goes dark for awhile. It seems like the spammer wakes up, turns on their computer, sends a bunch of spam and then shuts it down. Definitely not what’s going on: the botnets send the ~same message from a bunch of places on the internet.
I’d rather expected spam would be coming in constantly rather than periodically.
On a related note: I have a few parked domains I use for collecting spam. The mail received to a domain that was once active is quite different than the mail you get on a newly registered domain. If anyone has a parked domain they’re not using I’d be happy to collect mail coming in to it for training my spam filter.
You may be close. The spammer may initiate the batches of spam manually, such as when they wake up. After the queue has been run through, they may not initiate another until they again feel like it.