A trojan infects their PC, and takes control. The PC is then part of
a botnet, giving the person who controls it part of a supercomputer,
in effect. That evil bastard then sells computing time on the botnet
of stolen cpu cycles.
Although the malware can use a keyboard logger and harvest usernames
and passwords, it's not necessary for email because they can simply
forge the From: field to send spam (which is generally what happens).