I'm trying to figure out what my Girlfriend did. It never happened to me, so I'm unsure how it does happen.
Her hotmail account sent spam or something similar where you have to click on a link, to all her address book.
She's just a user on the Windows 7 computer, I'm the admin, so everything she does is under user privileges. I do have AVG running on the computer for virus protection but nothing for spyware and such.
The only way I can see this happen is if she opened an email and clicked on the link or executable. The executable wouldn't work (I think) since she's a user, unless it didn't install anything. So how does this work?
Your email account is not under the local account privledges at all. The only time it is if you are linking a file to an email and you don't have rights to use that file. Once something gets a hold of her account, usually it's hacked and the spammers actually logon as her on another computer, anti-virus won't see anything odd as sending emails to no matter how many recipients is perfectly normal. Unless there is a virus file sent out, in which case it will scan the outgoing email (if configured) and block it, or at least pop-up a warning.
If you have not done so, have her change her password to the email immediately.