Honestly, it's even simpler than that: it's the default domain in the email address dropdown when you go to sign up for Outlook.com/Hotmail now. The fraudsters aren't bothering to change the value in the dropdown, and they tend to create new email accounts frequently, so you'll see whatever the current domain is overrepresented.