Bucket - I'd certainly contact TyphoidMary and let her know her computer mightbe infected with the worm. But from what DjM says, it sounds as though it is possible that that might not be the source, too. So I'd include a link to some of the AV literature which shows how the worm can spoof addresses, so if her AV scan comes up clean she won't panic.

BTW Bucket, we have something in common. I'll update my profile.