Yeah your right for the most part but what seems to be happening is spam email seems to be making its way back and forth through a bunch of my users computers. They are also afflicted with loads of trojans and spyware but this is probably from click happy Internet users.

I'm in the process of rebuilding every machine on the network so I can start from a clean slate, this in combination with several tips above will help out a lot.