Hacked Email Repercussions?

I opened an email from, I thought, a friend. It asked me to click a link & sign in to read some documents. I did. No documents. Then started getting mail from people I haven't talked to in years. I realized this thing I had clicked was spam. I learned that several friends had received the "document" email from "me", and this likely had gone out to my address book stored on my server. Not all my addresses are there, most of them are in my computer. If they open it, presumably it will go out to all their contacts as well.

Must I warn all the people (maybe 100) in the server address book not to open it, that it wasn't really me, etc., and to change their passwords?

I changed my passwords immediately, but am concerned about all the others that this evil thing may have gotten to.