Yes. I remember ILOVEYOU too. It also confirms my point.

- It spread by reading the person’s contact information which doesn’t require administrator access.

- It also corrupted the user’s files and didn’t require administrator access for that either.