Sometimes spammers will forge the From address to be an address that is known to you so that the message appears to come from someone you know. This is particularly common when the friend has had their email account or address book compromised by a spammer, who is then sending spam to everyone in that person's address book.
If you are getting messages like this in your Inbox, you can turn off the Positive Whitelisting feature. That feature is described in this post.
Just change the setting to NO if you don't want spammy messages from (apparent) known senders to end up in your Inbox.