On March 19, 1997 a manifesto written by an anonymous anti-spam extremist, a complete list of Cyberpromo customers, the (shadowed) Cyberpromo passwd file, Sanford Wallace's root password and information on other notorious spammers of the time were all posted to the usenet groups alt.2600, alt.news and news.misc. The next day the Cyberpromo web site was defaced.
A week later in a WIRED article on the attacks Wallace implied that he had caught the individual responsible but was not releasing any further information. This is perhaps the main reason why some people believe that the entire incident was a ruse perpetrated by the lawsuit-embroiled Wallace. Theories on why he would arrange such an elaborate (and seemingly self-destructive) hoax range from publicity stunt to a desperate attempt at painting anti-spammers as criminals.
Due to this lingering doubt over the original message's authenticity the anonymous poster was dubbed "Hacker X". Ever since then this name has been given to any mysterious spamming (cr/h)acker who can never be caught by the victimized ISP because he most likely never existed.
Sources:
Usenet Message-ID: 5go3s4$7ot@uni00nw.unity.ncsu.edu
Spam glossary - http://www.sdmedia.net/argarg/spam901.html
Cyberpromo FAQ - http://www.rahul.net/falk/glossary.html#hackerx
WIRED "Cyber Promotions Attack Was the Real Thing" by Michael Stutz - http://www.wired.com/news/topstories/0,1287,2773,00.html