If they had then they would have been slammed for being anti competitive, because of all the apps by then that were using OLE automation to do things in Outlook. I wrote several apps for people that use the Outlook object model to send emails (book group appointments and the like). All of these apps would have broken if Microsoft had changed the rules.

Don't get me wrong, they probably should have done it, but it would have caused other problems.

Anyway, in this case it a moot point. The virus/trojan we are discussing is an EXE file, so once the user has run it all bets are off whether or not Outlook allows scripts to send email via it.