[stomachmonkey]

Unless you are running your own mail server her email is not being "sent" directly by her.

Mail is transferred from the local machine to the server that does the actual sending.

Who is the email provider? If there is a virus affecting her account it would would most likely be affecting a good number of users on the same server and they should be aware of it already..

1st thing is obviously to change her password. Many ISP's require user/pass for sendmail/SMTP to work. The user/pass is normally stored and passed without you knowing it so changing it shuts out anyone that may have gained access to it.

If it's got her entire address book it's more likely that she signed up for one of the less reputable social network sites. They encourage new members to "add all their friends to make them easier to find". It grants access to her address book and will send out invites as if they are coming from her. Same info can be sold/used as a spam list.

Spammers also spoof the from address. Meaning the mail says it's coming from her but it really is not.

I get spam from "myself" all the time. I especially like the ones telling me that the system administrators (which is me) are performing maintenance and click here to authenticate your new settings.

Unfortunately it sounds likely that her address book has been compromised and really there is not much that can be done to prevent it at this point.