yentingyenta – I swear it wasn’t me!
Seriously though, I have received about 4 or 5 of those from friends who got hacked. The email said something like, “Hey, check out this cool website”. I was stupid enough to click on it that first time and now I get HUNDREDS of spam emails directly into my inbox. If that is what your friends got, it may just be that, and not something harmful. Majorly annoying, but it was my fault for clicking the link (only once).
How did you check your activity? I have 4 or 5 accounts for different work stuff and only my personal one got spammed. I assume it was because that was the address my friend had.