you dont need admin rights to install things like that. They are designed to install using flaws in the system or run without -really- being installed on the system. Many reside as cookies in temp folders which all users have access to writing in, so as long as he can get online he can get spyware. Same thing goes with viruisis.