You won't get the virus unless you click the link. I got my first virus that way through MSN messenger, shortly after I got my first computer. I didn't know NOT to click. Now, whenever I get a link from a friend, I ALWAYS ask "Is that you, Rog?" If I don't get a personal answer I don't click it.
As for your friends getting it from addies not on their contact list, one way hackers garner email addies is from emails sent CC (carbon copy) instead of BCC (blind carbon copy). When it's sent via CC everyone can see everyone's addy. When it's sent BCC it only shows 'undisclosed recipient' and no addies are shown. I am a huge proponent of BCC mail, and will ask my friends NOT to CC me. No way I want strangers knowing my addy. It's all part of staying safe on the www
