Short answer to your first question: no one knows. Your request for the most common method for contact list harvesting is a tall order. The problem is although we have estimates of, say, the number of computers infected with viruses, or the number of data breaches, or the number of vulnerable websites, or the number of phishing emails, it's very difficult to know which source is the most common specifically for harvesting contacts for several reasons. We know that about 40% computers are infected with some sort of malware (bots, worms, viruses, trojans), but only a small percentage of these are for harvesting your contact list per se (many are for key-logging, snooping for financial info, bitcoin mining, and most likely: just sending out lots and lots of spam). On the other hand we also know that 37.3 million users (Kaspersky) experienced non-virus phishing attacks.
The problem is that our data suffers from selection bias because we only have data from antivirus programs which detect the attack, and because of this we don't know which attacks are the most successful.
As for resources: the best resources usually come from security firms which track these things the best they can. Here are several reports which describe the best we know about the statistics. But again, don't expect an answer to which source most likely takes people's (your wife's) contact list:
But if you're fine with the answer of 'we don't know', I can list how some of the attacks work (HAW) (in no particular order) and how to guard against them (WYCD):
- Data breach - HAW: Facebook/Linked-in/Google or another smaller site or hacked or have a vulnerability of all sorts - WYCD: not much just make sure you use different passwords for each site
- Direct hack - HAW: if a hacker knows enough about you, they might be able to guess your password, then they have direct access to your account - WYCD: make sure you have a secure password over 8 characters at least with no dictionary words.
- Poorly designed website is hacked - HAW: a large number of websites have vulnerablities (XSS, SQL injection, etc). If any of these have any way to connect you to your contacts this could have happened. WYCD: Not much you can do about this
- Bad Mobile app - HAW: a mobile app has access to your gmail contact list and is sent to a third party WYCD: don't install apps you don't trust; look at the app permissions you grant
- Wifi snooping HAW: most wifi APs bleed all sorts of personal information to the open. WYCD: use encryption as much as possible (https not http) (gmail has this)
- Phishing - HAW: Either through email or social networking a user is tricked into visiting fake a site has the user enter their login information or asks for this information directly over email and the account is hijacked or, as you mention, get direct access to your email through CSRF. WYCD: Install a good AV program which has a good phishing heuristic
- Malware (Bots, Viruses, Trojans, Worms) - HAW: Although there are all sorts of viruses, a few of them do try and grab your contact list from an executable. Java vulnerabilities are very popular lately. Someone will send a java file, and a single double-click and it's installed. WYCD: only open attachments from trusted sources and make sure you have a good AV program.
- Browser vulnerabilities - HAW: All browsers have vulnerabilities, sometimes visiting a malicious site can trick your browser to installing malware . WYCD: make sure you have a program (most AVs have it) that warns you about malicious sites - there are also browser plugins that do this. Also keep your browser up to date (and OS) with latest security fixes.
There are actually many more. But I would say these are the 'most common'. Go through the reports above to get an expert assessment of the state of software and web security.