You know guys & gals...

Maybe he has his terms mixed up?

Because from what I've read...
that are sent thru hotmail and other online email services and capture passwords if they are replied to
If we remove the word Trojan...It sounds like one of the vulnerabilities Hotmail HAD with it's ability to parse scripting languages.

What you may also be talking about is something called Cross Site Scripting (XSS)!
In that case, it would be an unsuspecting link..that when clicked would send a user's cookie to an attacker. The attacker could then use the cookie to access the users email (assuming it was within a certain timeframe)

Hope that helped

Simon Templer