Adrian sends me an e-mail we consider one of the most ingenious spreading techniques ever.
Only working with Yahoo! mail at this time, the html mail has an img tag along with an onload javascript handler. When someone opens the e-mail, the javascript code uses XmlHTTPRequests to retrieve your e-mail contacts and to forward it.
The actual code (taken from the e-mail virus) is
here. Samples:
<img src='http://us.i1.yimg.com/us.yimg.com/i/us/nt/ma/ma_mail_1.gif' target=""onload="var http_request = false;
...
makeRequest('http://us.' + Server + '.mail.yahoo.com/ym/Compose/?rnd=' + Math.random(), Getcrumb, 'GET', null);
Filtering onxyz javascript handlers should definitely fix this.