Even if the default is to only accept messages from friends, worms certainly spread this way. If you want an example, see one of the MSN worms: they simply send

Even if the default is to only accept messages from friends, worms certainly spread this way. If you want an example, see one of the MSN worms: they simply send a link, which if clicked it sends the worm through to all of the people in the contact list.