Honestly, that sounds like phishing. The hacker compromises the email account, runs through the database of contacts and then spams out messages with links that may or may not be hacked and compromised as well.

Ya'll might want to run some anti-spyware and anti-virus scans on your systems pronto.