How would someone know to email a hacking attempt to an unpublished email address?

[canetoad]

3. The employee

Most likely has an infection on their computer - an email worm or trojan.

This piece of malicious software trawls through address books on the users computer, finding email addresses stored there. Then it replicates and sends itself out to the addresses found.

Best thing to do is let your colleague know that they need to do a full scan of their computer.