It is possible her account is compromised, but it is also possible that it is not. The same goes for her computer.
First: Spam email sent from her email address may not actually be coming from her computer, or even her email account.
If spammers find a valid email address, or, even better (for them), a valid address book, they'll begin sending email messages from their own servers but set up to appear as though they were coming from that valid email address. The only way to tell the difference is to look at the headers of the email message and determine whether the server that is sending the emails is authorized to send using that email address.
If this is the case, she simply needs to send emails to all her friends letting them know that the emails they receive from her may not necessarily be really from her. The problem will usually go away within a few weeks. If it doesn't, she should change her email address.
Especially because you've already run scans on her computer, it would appear unlikely that the problem is a current and ongoing infection on her computer. Use the steps outlined in the antivirus walkthroughs elsewhere on this site, and then just advise her to wait it out.
possible duplicate of Tips to give to end users to avoid having their online email (Gmail, Hotmail, etc) being hacked?
– Ƭᴇcʜιᴇ007 – 2011-09-19T16:38:25.320When you changed their password, did you also change/update the security questions and answers (which can be used to retrieve and/or reset passwords)? – Ƭᴇcʜιᴇ007 – 2011-09-19T16:39:38.390
Who's e-mail is spamming. In the tile it says yours in the question it says hers. Which is it? – Joe Taylor – 2011-09-19T16:42:21.410