They can get them from many sources,
- Datacenter, borrowed, leased.
- ARIN of course.
- Big client with a big allocation
- Generous carriers / upstreams
- Block used already for other things (eg: mailing)
In my case, i have a datacenter and ive got a couple of B classes that i could use for proxy, im trying to contact Harro so i post an offer shortly, i could do 1 dedicated server with 4 C blocks and a 100 Mbps port for a reasonable price.