Question : User's Web-Based AOL Mail is sending spam to all his contacts

User had a problem with Malware that was cleaned up. He uses web-based AOL mail and no mail client on his computer. A week after the malware was cleaned up (using Malwarebytes, Spybot Search and Destroy etc.) all of his friends got an email from him about Viagra.

I had him change his AOL password.

How do you think this happened and is there anything else that should be done at this point?

She is on a Windows Vista machine.

Answer : User's Web-Based AOL Mail is sending spam to all his contacts

Having her change her password was the right thing to do.
Unfortunately it sounds as if her email address was hijacked. Meaning, they have the address and spam people using it. For all appearances it's coming "from her". I had the same thing happen to a Yahoo email account. Unfortunately it's not that uncommon.
The other possibility is that the malware was not completely removed. However, being as that the mail client is web based and not installed on the system I would doubt this to be the cause of the spam under her name.
You could always boot into Safe Mode on her system though and run your scans again.