This seemed a little low to me until I saw the specifics: 2.15 million bot infections were detected and removed the 2nd quarter of 2010.
AND 2.16 million bot infections were detected and removed the 1st quarter or 2010.
These are just the ones found by Microsoft, and only the ones they removed. Again, this doesn't include ones they didn't remove (or didn't detect). Also it doesn't include any other vendors.
Now it sounds more like the numbers I was thinking of...