The "from" field may have been spoofed by the zombie machines that sent the virus. A comparison of IP addresses of the members vs. the virus senders may exculpate the members, but if they are running open machines, then their ISP should notify them and disconnect them until they can disinfect. However, if their ISP is in Korea, Singapore, Philippines etc., there's not much chance their ISPs will respond in any way.