The 'virus' (for want of a better term) gets into someones email client via facebook. There are many different facebook 'add-in' programs, and Im not sure any of them are official.

So, in this case, through Ron's facebook (which he actively uses), it gets on his machine and sends that email to selected (or all) email addresses in his address book.