Help analyze this, how can she be hacked

[Neil Watson]

Yes, Joe Jobbing is the most likely explanation

http://en.wikipedia.org/wiki/Joe_jobbing

Every so often my mail server gets a return of emails I did not send
which must have originated from a Joe Jobber.  There is little one can
do to prevent this.

If you look the headers you can usually see how they are forged.

There is one concern though and that is if these emails are being sent
to your friend's contacts how did the spammer acquire them?

-- 
Neil Watson
Linux/UNIX Consultant
http://watson-wilson.ca
--
The Toronto Linux Users Group.      Meetings: http://gtalug.org/
TLUG requests: Linux topics, No HTML, wrap text below 80 columns
How to UNSUBSCRIBE: http://gtalug.org/wiki/Mailing_lists