Customer: “My spam volume is down – is it you guys?”

MailChannels tracks (in real-time) the email flows hitting our customers worldwide. We use this data to establish a fairly comprehensive reputation score for IP addresses we have seen many times – mostly as a method for automatically “whitelisting” IPs which have a long track record of sending good email.
Recently, a customer of ours asked us to prepare some historical data showing the performance of Traffic Control at their site over time. We were somewhat surprised to see that the volume of connections they receive each day has dropped to just a third of what it was last September.
What has caused this drop? We’re not really sure, but here are some ideas:

• Spammers have chosen to “blacklist” this customer’s servers, because they are noticing the customer is slowing down most spam-bot connections;
• Global spam volume is down by two-thirds (haven’t seen this with other customers, so we don’t think it’s likely the case); or,
• The recent demise of a few well-hyped botnets because of Microsoft’s ongoing efforts to patch up Windows XP.

What do you think? Why is this customer getting so much less spam?