It's the pointlessness of it that boggles the mind.
Would you agree, however, that the most likely culprit (ruling out her own machine) is that one of her recipients has a compromised box?
What's the link, btw, to the trojan you were reading about (if it's semi-handy; don't waste time hunting...