Simon Janes, international operations director, ibas, answers: "This is an excellent point and one which encompasses the whole grey area of the personal use of company IT. The short answer is maybe. There are many factors to consider such as: what is the company IT policy for both IT and email usage? What is the staff expectation of privacy and security that is enshrined within that policy? Within the Data Protection Act there is an onus on the company to operate sufficient security to protect data. However, would this apply to an employee using the IT system to conduct their banking?

"This is a very real problem for system administrators and security managers alike. The only practical way forward is to conduct a thorough risk assessment, and to detail and mitigate those risks in any subsequent policy. This policy will then set out what is acceptable use and what can be expected in terms of privacy and security if personal business is conducted."

David Naylor, partner at law firm Morrison and Foerster, adds: "The short answer is that, in the UK at least, if the employer takes a few common sense precautions, it is unlikely to incur liability in these circumstances.

"These precautions include having in place a 'technology use policy' that forms part of the employment contract. The technology use policy should set out how the employer's technology resources may be used by employees, ensure that employees understand that the company's resources are primarily for business use and that they should not assume that any personal use is private. All this information should be in plain English and clearly drawn to the employee's attention."

Graham Cluley, senior technology consultant at Sophos, answers: "This is a real nuisance, often creating as much of an email tornado as the viruses themselves. All antivirus vendors should look at their gateway antivirus software and ensure that this option is removed, or at least disabled for viruses which forge the sender's information. I think it was one of those things that antivirus programmers knew was easy to implement and so included, but never realised how much of a problem it would become.

Alyn Hockey, director of research at Clearswift, answers: "There really is little you can do, they have your name and they will use it as a new source address for the message. Companies frequently set up lists of email addresses to block mail from. It will be very unlikely that your address will be on it, so using that address gets past at least one hurdle at the recipient's mail gateway."

Paul Wood, chief information analyst at MessageLabs, answers: "Spammers often use spoofed return addresses. They'll often just pick a legitimate email address at random, and use that. However, there is a new system called Sender ID (as mentioned earlier), which takes your suggestion to the next level, checking not only the return email address, but also the originating server's address. If the originating server isn't authorised to send email on behalf of the domain found in the return address, then it's probably spam. Sender ID will be introduced over the next few years. The spammers may move on to creating new fly-by-night disposable-but-still-legitimate return addresses, with matching servers, but it may stem the tide a little.

Graham Cluley answers: "Aha! A legal question. If you read the small print of your antivirus software's license agreement you will almost certainly find that you do not own the software itself, only the media on which the software is contained. Furthermore, if you read the disclaimers (even tinier print) you'll almost certainly see that the vendor does not warrant that the product will detect or disinfect any viruses at all.