How is spam relaying done?

[James]

I know that removing rcpthosts is a very very bad thing because it opens
the door for spammers to use your server to spam, but I haven't heard HOW
a spammer *finds* such a server to begin with.  If one removes rcpthosts,
what are the chances that anyone will find this out?  How does any spammer
get such information?

james