I recently started farming a twitter account by using the rough code I'm writing for a twitter farming service. First day I followed 1000 people and within a few hours had 380 followers. What I was surprised to find is that about 60 of those were people I wasn't following.
I suspect there's people out there who are closely following who others follow and matching. One becomes two, two becomes four, etc.
As for exploits, Twitter now does OAuth which will allow any third party service to use your account without ever having to get your password. I'm going to be using this to create a service that creates and follower-farms automatically, as well as providing follower-farming for existing accounts. Looks like I'm about a week away from something usable.