Isn't it possible that the spammers are using the API used by Yahoo's Android application from the usual compromised desktop machines, rather than from Android devices themselves? All of the information required to do so would be available from analysis of the Yahoo Android application.