Who are they and why would they do that to innocent people?

Perhaps more importantly, how can they even tell when the data is inaccurate? I have a hard time believing that domain contacts are inclined to respond to unsolicited unprovoked third party "offers" to verify their address. Hi, can you let me know that someone is reading this so I can start sending you an unending stream of spam? Meanwhile just because you have a third party whois privacy service doesn't mean they don't faithfully forward your mail.