We got a warning from the ISP the other day that Gretchen's e-mail was emitting spam. We've scanned all of the machines she uses for viruses and changed her password, but a new flock of messages apparently went out claiming to be from her today. However, we didn't get a warning from the ISP this time, so it's entirely possible that this is from the previous batch of address harvesting.
In any case, I've now scanned the machines that Gretchen uses with a different virus scanner. This one found some things, but it doesn't appear that any of them were actually live.