There are a couple of things that can be going on with your friend's account, one of which is that she could be the victim of what's called a "joe job", when someone sends out spam to a random list pretending to be you. But they're not, and they haven't broken into your account, they're just using some software that lets them specify "from = x@hotmail.com" and then looks just like they've used your account but haven't.

After all, if the message you got from your friend Pegah was addressed just to you (e.g., had your yahoo.com email address as the "To:") then that would imply that they sent messages one-at-a-time to each and every person in her address book. And that would be really tedious, wouldn't it?

However, since you two are friends it sounds like it's probably not a joe job after all, but rather that somehow her account has indeed been compromised or broken into somehow. Not good.

First step if you think you've been hacked: Change your password immediately!

Now, let's try to figure out what's going on. If your friend didn't need to log in to her account that suggests that anywhere she's previously logged in to check her email (like a public computer at the library or at school) remained logged in and if the next person on the system simply went to "hotmail.com" then they might well have found themselves logged in to her account. That's why it's so critical not to check the "stay logged in" box on any computer other than your own secure system.

Another possibility is that she has a virus or keylogger or spyware on her computer that let someone identify her account and password, then utilize them. I suspect that's not the case, but it's always good to run some decent antivirus and antispyware software to see if there are any issues. One that's a good option and is free is AVG.

Finally, and this might be obvious, never, ever, ever share your password with any of your friends. BFF or boyfriend, it's not that they are going to do something bad but that they too might make a mistake and log in somewhere unsafe then never tell you. Not good.

Hope this helps your friend clean things up. Again, step one, your immediate reaction to anything of this nature should be to immediately change your password to something new and complicated.

Good luck!