Yea, I agree a lot of spam does come from compromised users, but you would think they could monitor the out flow and tag boxes that were sending too much or set up special accounts for those people that were going to send lots of emails and try to dry up the abuse of free email accounts. The rest of it comes from smaller servers with admins that don't know how to stop it or can't afford to watch it or don't really care.

It's simple though really, security costs money and time. You can make your profit margins look better by simply not doing anything in some areas. Let the public eat the expense. Never mind worrying about being the means. 

As far as search engines, I'd say they need to change the system. Anyone can attach key words to their web pages to get hits from search engines as far I know; so what is to stop crooks from using it to spread trojans and viruses? Nothing but maybe getting caught and punished. How do you grab the bad guys when the country they come from doesn't care or doesn't have the resorces to enforce the rules? Another subject I could ramble on about. New laws when the ones made already can't be enforced because of the cost.

They're going to have to do something though because the internet is getting so diseased it's hard to use it without getting infected and the patches are making solid programs run less stable. Look at XP and all the security updates. In some cases the patches need patches.