To complete the answer......

It doesn't matter whether your user is sending mail to these domains..... They aren't. It's virus activity. Your user is in a newly infected computer's address book and, lucky them, they got selected as the forged "From:" address. Out go all those nice viruses and the faked sender gets lots of NDR's and "Virus Found" messages from the recipient's email systems......

It's just more of the white noise of the internet these days.