Google may index a lot of the spam as relatively useless since it is often found at top levels. If the number is correct what it is probably missing is all of the content that lies in databases, easily accessible, but not necessarily on the front pages of web sites, or found without entering a query of some sort.
