FIrst of all, are you sure that your sister actually added him to her contact list?

Or has she fallen victim to a phishing attack and had her password hijacked by someone else? I have seen this many times before, and it is especially easy on preteens with little to no knowledge of such attacks.

This would be my first guess, and if so, this has nothing to do with any vulnerabilities in MSN messenger. You sister should definitely change her MSN passowrd immediately. Adding someone to a contact list without prior approval is a trivial task for anyone with minor knowledge of the subject.

Go through the message history, see ifr any links have been offered to her where she may have clicked them, perhaps a "enter your password to avoid account deactivation" kind of thing... I would bet my bottom dollar that this is exactly what happened. Educate her about the dangers of following unknown links, encourage her to change her password, and all should be said and done I hope.