One of the features of the Klez virus is to grab two e-mail addresses from the infected computer's outlook address book and use them as the from and to addresses. So, the infected computer had to have william@userfriendly and your customer's e-mail address stored in the address book.
Have you checked all of your systems?
