Recently a Twitter vulnerability was leaked that allowed Twitter users to type ‘accept username‘ (where username was another twitter user) and it forced that user to follow you. For instance, the last time I looked Conan O’Brien’s account had over 300 followers. Even though he said he was only going to follow 1 random person (Sarah Killen @LovelyButton).
UPDATE: Twitter has responded to this vulnerability and is in the process of rolling back the invalid follows.