I've reported it to admins via various methods (eg Spamcop), and Google was declining to accept spam reports. (ie Google's email contact address was listed as "google-abuse-bounces-reports@devnull.spamcop.net") I'll double check that is still the case and try again with Google when the next one comes through.

The spam I'm talking about almost always has "new autobot" or "new cryptobot" in the subject, and usually has an infected PDF attached. A simple outbound check for that would be enough to flag likely compromised accounts. That's the simple filter rule I'm using to kick it automatically into my spam folder for later review.

One of the more egregious servers is mail-lf1-f48.google.com:

https://www.abuseipdb.com/check/209.85.167.48

But it's also coming from mail-yw1-f180.google.com, mail-yw1-f181.google.com and mail-yw1-f182.google.com, and those are just the servers I've seen in the last 24 hours.

https://www.abuseipdb.com/check/209.85.128.180

https://www.abuseipdb.com/check/209.85.128.181

https://www.abuseipdb.com/check/209.85.128.182

I am assuming it is the Google accounts that are compromised, and not Google's own mail servers. But I suppose it's possible that Google itself is pwned.