How do they do it?

I received an email supposedly from a friend who is in my yahoo mail contacts. It was asking for money of course for a sick relative etc. I knew it wasn't from my friend. His address is eleven letters long with a "t" in the middle @aol.com. When I looked at the fakers address it was almost exactly the same but had a second "t" in the middle. Easy to miss. So how is it that they gained access to my yahoo mail contacts list and what else can they see?