How To Deal With Spam Email From Yahoo?

My wife's Yahoo account has been spamming everyone in her address book recently with messages like "I've been searching for it for ages!" or "Unbelievable! What a wonderful thing! You can't miss it!" with links that no doubt load a site full of malware/spyware. She only has a tablet and smart phone, so there is no Windows OS involved (and it's very unlikely either of these are infected as I have security set up on those). But she does use this email all over the web and doesn't protect all that much (because it's Yahoo).

Is it possible that someone online has gotten a hold of her email and is spamming everyone in her contacts list. How is it possible they have access to this address book without being able to log into her account?