[n_u_l_l]

What might have happened is that an admin account of the university has been hacked, and someone is abusing it for spam.

[duskwuff]

Or a large number of accounts were created with placeholder credentials which were compromised in mass -- for example, passwords set to dummy values like "changeme", or to predictable values like the student's last name.

[908B64B197]

Sounds plausible.

It's a good thing to shut down early this type of spam, else other providers might start blocking *.tw domains and it will take longer for them to get unblocked.