Of course somebody is interested in spamming his mother's blog. A script doesn't care whose blog it spams. Now that the word is out, I expect it will only be a matter of time until such scripts emerge.

It's the typical false assumption non-technical users have about security: who would be interested in hacking me anyway? Automated scripts, that is who.

Also, how are the email posts interpreted by posterous - is it possible to post custom html snippets and javascripts via email? This would be scammer's heaven, as they could probably even hide that a blog has been spammed.