Interesting business. Surely send phishing emails or try to send a Trojan. Has anyone tried to handle? :) ')
UPD KeJSaR gave a link where it is described how it is done: first, they send you a letter supposedly from a cracked mailbox (and in fact with a forged address), and then demand money for the password (disappear after receiving).