Quoting jgarzik: "Dear headline writers, A pool cannot simply generate a large TX from other peoples' bitcoin."
https://twitter.com/jgarzik/status/619970170287751168
https://twitter.com/jgarzik/status/619970170287751168
Jeff Garzik is not clear about what is happening, because the article is correct, but it does not explain what is going on very well.
The "spam attack" is creating thousands of inputs with dust in brain wallets with passwords like "password". The pool is simply claiming that dust. It can because it knows the private keys of those addresses (just like everyone else). It can do it economically because it doesn't have to pay fees for any transactions in the blocks it mines.
For example, take a look at 16ga2uqnF1NqpAuQeeg7sTCAdtDUwDyJav. It's private key is 5JXvHQfGHxUffo8BLRG1RBecRCZ2Jygtx...
