This has actually happened -- with the spam mail following the same template as yours -- to at least three Hotmail accounts I know, one of which is my old account and the others my friends'. This was maybe three or four months ago, that is before Firesheep (yes, I know Firesheep is just a pretty UI to a general HTTP sniffer). IIRC, on Hotmail the mails did show up in Sent though. I'll check when I can -- on the bus right now...
I'm fairly certain that the system I used to access that account (approx monthly only, to make sure it didn't expire, just in case) was and is clean.
I'm fairly certain that the system I used to access that account (approx monthly only, to make sure it didn't expire, just in case) was and is clean.