Someone I know has started getting the SoBig emails at her Hotmail account. Supposedly only a few people know her address there (all friends or family).

I think it's probable that the infected person is someone who knows her Hotmail address and who also knows the ten or so addresses we've seen the bounces from (bounces due to full inboxes, or "virus detected from you"). Is that a reasonable place to start, i.e. call the few people she has given the address to, and ask them if they know the addresses from which the bounces are coming?

andrew