Spam does not require anybody to actually take the bait. It requires one sucker (the guy who commissions the spam run) to think that enough suckers will actually take the bait. If he loses his money (as he richly deserves) and even suffers bad consequences (ditto), the spammer (who deserves to be boiled in oil) still has the money.