They may have started with reading Steem blockchain in the beginning and also writing because it appears that some bots are still posting Byteball addresses to every post that has #byteball mentioned.

I am not sure 100%, but it might have been that some bots later started reading Byteball DAG too, especially those accounts who were popular Steemians and sent 50 000 bytes to many people. And then the bots did the same thing.

Also, many people had a misunderstanding that if the bot asks 49 000 then they need to send that person 49 000, but actually this person needed more. So bots took advantage of that too by sending more accurate amount. I explained attestation fee and transaction costs in this post.