To hide the identity of the phisher, phishing attacks are not sent from the phisher's computer. Instead, a phisher uses or hires a person who controls an army of thousands of zombie PCs whose owners don't know they have been turned into zombies. The person controlling the zombie army tells them to send out the email composed by the phisher.
