Stardate 20010703.0712 (On Screen): I suppose this was an inevitable step: someone has create a trojan which uses the machine it infects to send spam. I don't think this is going to become a problem. The idea is that what it will be sending is commercial advertising, but that can only be useful if it actually contains contact information for a company: a URL, a phone number, a PO box, or
something. And that, in turn, leads to an obvious target for law enforcement authorities to begin their investigation, since creating and distributing a trojan is a felony. If you're going to break the law, it's not generally a good idea to sign the results.
Of course, there's a different way this could be used: find a company you hate and create spam purporting to be from them. The resulting firestorm of protest would then land on the company you hate, and there wouldn't be any obvious link to you. (discuss)