My girlfriend recently had her university MS Exchange account hacked. The attacker took over her email account and started using it to send thousands of spam emails. After a while, her email account must've hit some kind of limit, and the university server started sending her an email for every email that the spammer attempted to send from her account!
Anyway, she remembers accidentally clicking a phishing link in an email in webmail on her MacBook Pro that claimed to be an email from the university's IT Services, but that's all. Apparently, the link "did nothing" and closed immediately. She did NOT fill in any form that asked for her email address or password.
Despite changing her password, the attackers did not stop. How is this possible? Her Exchange account is linked to the university's central account system, but I'm not sure how exactly. Anyway, changing one password changes the whole thing.
Now IT services is telling her to reinstall everything (Mac OS X, files etc) on her laptop before they agree to re-activate her university account. This seems wrong to me - how could the laptop be infected, if all she did was click a link in an email via webmail? Is that even possible? (I expect she was probably using Firefox). They are worried that she has a rootkit virus.
Update: I forgot to mention, she also had Sophos installed. Not sure exactly how up to date it was.