Originally posted here by bigb
It dosen't need to have an attachment to be a pain in the ass. Some worms exploit scripting language vulnerabilities, allowing all sorts of actions to be performed on the target. His friend probably opened an infected email.
I think bigb brings up a good point.