[Rathji]

It's actually really interesting.

For targetted spam the botnet comptuer will take its contact list, and scan and analyze your common email structure, grammar, spelling etc, and send the emails using this information, with a fairly believable email. Spam filters don't catch it, because it doesn't look like spam, and people click the link because it looks almost believable.

Spearphishing, AFAIK, farms data from as many sources as possible and then compiles an email that you might normally receive. Twitter or Facebook notifications would be a very good example of simple spearphishing, but it can get a lot more complex in the hunt for financial info.