I should probably charge you a consulting fee for this, but:

I actually do run Mail servers, they are bigger than yours almost for sure and I can promise you about 10 times as much spam comes from gmail addresses as hotmail ones these days.

Maybe they are bigger, although in the 30 years I’ve been running mail servers, they’ve varied in size from “tiny” to “among the biggest and busiest on the net”. And one of the things I’ve learned is that size is not correlated to clue. Another is that anyone who can competently operate a mail server with 10K users can operate a mail server of arbitrary size just as competently.

As to your comparison of volume from gmail vs. hotmail, you’re making a beginner-level mistake here. Everyone who has studied spam in any depth knows that spammers target differentially: by country, by ASN, by network, by host, by domain, by MX, by OS, by MTA, by user, by LHS, by just about every criteria you can imagine. So one of the fundamental truths about anti-spam work is that your incoming spam mix does not look like their incoming spam mix, for all values of “your” and “their”. Thus your observation, while presumably accurate, means nothing for anyone but you: it tells us precisely zero about the actual spam rates from either operation.

So if you actually want to assess patterns on anything approaching a global scale, one of the things you need is a very large number of measurement points, AND that very large number of measurement points has to reflect sufficient diversity among all the criteria I enumerated above — plus a few others. This is difficult not only because of the scale, but because considerable craftiness is required to operate the measurement points. And then even more clue is required in order to combine the measurements in a way that actually means something.

Also, STMP security involves forcing authentication, which hotmail does.

It’s SMTP, and only some SMTP security involves authentication. As I would expect anyone who claims to run a mail server to know, there are many injection paths which do not. For example, Hotmail emits backscatter (aka outscatter), which is a particular form of spam that does not even require the spammer to have a Hotmail account.

Beyond that, authentication is not a barrier to spammers running botnets, since they can possess and use at will any email authentication credentials stored or used on those systems. Thus — as we’ve seen — spammers will sometimes choose to use their bots not to directly send spam, but to relay it through third parties…some of which dutifully perform the authentication, which of course succeeds.

They clean up their mess as much as anyone.

Of all the things you’ve said, this is the most ludicrous. Everyone who has been paying the slightest attention to traffic among professionals in the field over the last ten years (whether that traffic is on mailing lists or in newsgroups or on the web or whatever) is well aware that Hotmail is absolutely, profoundly, completely incompetent at dealing with abuse and security issues. They have demonstrated, thousands of times, that not only can they not read well-crafted reports, not only can they not tell an abuse report from abuse, but they quite often fail to recognize their own hosts and networks as such.

That is, as someone once said, a special kind of stupid.

Here’s an exercise for you: go over to Google. Type in “hotmail abuse clueless” and start reading the hits. When you’re done, switch the search from the web to Usenet…and read some more. And then search…well, by now you should get the idea. Hotmail’s abuse desk is legendary for their incompetence — although they do have serious competition from Yahoo for worst-in-class.

Yet this is not the end of the issues with Hotmail. As I said previously, spam is only one of their many problems. It just happens to be a particularly easy one to observe.