If you read e-mail in HTML (nice colors & fonts, embedded pictures) and scripting is enabled (not sure if it's all types of scripting), you can be infected.

I don't see any need for all the bells and whistles in what is primarily meant for communication. I have my e-mail program set to read text only. Also, unless I know something's headed my way, if it takes too long to download, there's a possibility it's going to get deleted from the server without me seeing it. I've got a dial-up, and one or more megabytes of fru-fru is more than I'm willing to download.

Also, just because it appears to come from someone you trust doesn't mean you can trust the e-mail. People who mass-mail irresistibly cute things can be fooled, or their e-mail address may have been previously collected by one of these trojans and it's not really from them.

I know I'm just a bit paranoid, but it doesn't interfere with my life and I tend not to have problems with malware.