I run a mailserver which handles email for about 100 active domains, and it is simply ridiculous the extent to which the spammers' network of compromised machines circles the globe.
I saw the same piece of spam from the same spammer being attempted to be delivered to a user - one IP was in Japan, one IP was in the US, and one was in Poland. (All were rejected.)
To my view, the problem is the creeps who write and generate viral programs and spyware, and spam.
But, I completely agree that the responsibility for security is on the end user.