People typically have very little control over the security of the other systems they depend on. His machine may not have been hacked. That address book info could have been stolen from gmail, or from his ISP. Since I have no idea what happened, I see no need to shame people or start finger pointing.

A couple weeks ago I got hundreds and hundreds of flames from people who said my primary email address had spammed them. I posted about it here, remember? I could not find any evidence that my machine was compromised. I think some spammer just spoofed my address. The people flaming me were being idiots. Why would I follow their example?