Yeah, but they don't bother checking for nofollow attributes. Not spamming people who enforce nofollow attributes would just encourage more people to adopt it, which the spammer doesn't want.
Either way, the spammer rarely spams his own thing. They spam what someone else pays them to spam, and don't care if it actually works as long as their customer believes it works (much like legal advertising).