[masraum]

99 times out of 100 when you receive an email from someone that you know that's spam/virus/whatever, the email didn't actually get sent from their account. Most of the time, someone that has your email address in their address book got hit by a virus/worm/etc... that mined your address from their address book. The email comes from X, but they put Y as the source email to make it look more friendly. Your account (or family members) probably has not actually been hacked.

I can send an email and make it look to most folks like it's coming from anyone any where (unless you know how to look at the real source).