Emails sent out always marked SPAM

Probably the SPAM flag has been added by the receiving ISP.
It is likely that her e-mail address or even the domain on which she has her e-mail address has been registered in a central SPAM database being used by ISP's. (Could even be the IP address being used by her ISP)

Another alternative is that she has some piece of text in her mails (disclaimer ?) which uses words which are picked up on by SPAM filters.

In short, it sounds like she has ended up on a blacklist.
Best thing she can do is contact her ISP and find out whether this is the case and if so, why this is the case and if rectify the issue if necessary. Once this is done, she can ask to be whitelisted again.

Being a university doesn't protect you against blacklisting, although it should be easier for them to whitelist their domain.
If the university's mail servers are open-relay servers for example (I know of some uni's that are, they will automatically end up on the blacklist)
However, an individual e-mail address can be blacklisted also.
Having NAV or MS Anti-Spyware on your machine is all very well for stopping the incomming rubbish but it isn't going to help much in the outgoing.

Do recipients within the university also receive her mails as SPAM or is it only for external recipients ?

Checking individual email addresses isn't easy but you could start by checking the domain.
I had a quick look at the Spamhouse SBL and could see at least 6 or 7 US colleges/universities with issues.

At the end of the day, I don't think you can do much about your friends problem just by looking at her PC. The flagging of SPAM happens on mail servers or sometimes on receiving PC's, not on the sending PC.

Are all outgoing messages being prefixed with [SPAM] or just all the ones you're receiving? Have her send a message to your hotmail (or whatever) account and see what it does.

My GFI MailEssentials systems flags inbound messages as [SPAM] based on charcter set recognition and phrases found in the body of the message, this sort of information is relayed to the end recipient in the subject line so the end user can let the sender know to try to avoid using specific phrases or subject lines that are known to trigger the filter.

SPAM filtering is virtually never done at the sender end, logically the flagging must be coming into play at the recipient end of the connection. The problem is not on her end, its on yours.