One of the Yahoo email API issues was exploited by attackers using the index of address book contacts. So the address book wasn't directly leaked but they were still able to enumerate how many contacts you had and use them to add the element of "from someone I know" to the dodgy emails they sent.
E.g
Email this to address book entry 1, cc 2,3,4
But yes I still get emails from random sending addresses showing that friends Yahoo address book were exposed in some way in the past. There was a spate a few months back of one line emails from Yahoo again, but they seem to have cleaned it up again.
