What has the security of Linux and OS X got to do with the production of Spam? A lot of companies that spam buy software that produces spam in vast numbers - look what happened when the US court managed to get the ISP of America's biggest spammer to switch him off; spam fell over 30%!
That was someone deliberately sending out spam, from a farm of machines, not a bot-net.
As to the security of OS X and Linux, both are equally susceptible to phishing attacks, the same as Windows - well less so, in the last round of tests, IE actually came out ahead of all the other major browsers in terms of phishing protection...
Windows 7 also includes better security for buffer overruns and randomisation of code locations - OS X does it for applications, but its key libraries, unlike Windows, aren't randomised upon loading, so they provide a much easier vector of attack than Windows 7.
User education is the biggest problem. And that covers all platforms, not just Windows. Nowadays, a lot of the vulnerabilities are less serious for Windows users, because a lot of the remote access bugs found recently only work on local networks.
The biggest problem at the moment is the man-in-middle SSL attack, which Marlin Spike demonstrated recently, using ARP spoofing, it can intercept all traffic between a secure server and a client and pass a non-secured, or a secure page with the invalid Id, which comes over as valid - a flaw in SSL, which affected IE, Safari, Chrome and Opera, but which was fixed last week, which allowed the valid name to be followed by a null and the invalid domain and the SSL certificate was shown as valid on the client, even though it came from an intercept.
That allowed Marlin Spike to intercept a couple of hundred user ids and passwords in a 24 hour period in at a local public wireless access point! That has nothing to do with operating system, just the poor implementation of security in web browsers (as a whole).
To be really secure, a "new" Internet infrastructure is needed, which is designed around security - the current system was designed around a closed private network, it was never intended to be used for a large international network, where "bad guys" would also have access, so hacks have been continually placed on top of the networking infrastructure to make up for it, but it is inherrently broken.