[stomachmonkey]

Changing the password will prevent her account from being used by someone else. But it's highly unlikely that they are using her actual account.

Yahoo will see the high traffic that spamming generates and would just shut down her account.

But if her list is already compromised nothing will stop it.

Facebook themselves are not a problem. It's some of the things that you get "invited" to join. Some of them will ask for access to her Facebook contact list and that's how they get her friends email addresses.