Are you both running an anti-malware program? Or was your password something simple? All it takes is clicking one of those links in a spam email and boom, you just installed a monitored key logger...