This is a bizarre one. I got a couple of emails from WhatsApp telling me I have got some messages. I delete them as they look a bit dodgy.

Anyway, my wife gets a couple and she clicks on the link - she thought it was trustworthy as it seemed to come from a friend. She's taken to a fake BBC web page about some weight loss thing. She closes the browser window.

However, it seems that a lot of emails have been sent on her behalf to her contacts (including me). She says she was not asked for any password. She wasn't prompted to download or install anything. The emails were just sent.

I have no idea how this works. I've been digging around, and finding that this happens for any platform. This rules out Flash, as iPads seem to be affected. So it must be doing something via JavaScript - but how? That's all locked down, right?

My wife's Apple account was locked, so she had to change her password (this was via the Mac's usual interface).

I've never understood WA spam - quite often you get sent a 'business card' or 'if you don't update you'll lose your account', but none of them have links or anything so how is it supposed to work?

99% of spammers are utterly clueless, even about the software they're using to spam people. Sadly 1% of spammers is still enough to be a massive pain in the arse.