Question about how spam comments happen

My blog is relatively new, and most of the comments I’m getting are spam. I get an email from WordPress describing the comment, and it gives me the option of Approving, Trashing, or Spamming. And as I understand it, the comment won’t appear until I choose Approve. If I click Trash or Spam, the comment will NOT appear. Uh, I think.

With that in mind … this happened: My friend “K” left a comment, which I WOULD approve. I received that SAME email with those three options, but THIS one didn’t come from WordPress … it came from “K” … that seemed odd. Before clicking anything, I went to that blog post, and her comment was already there, without my approval.

So if “K” can do it, logically, spammers could, too. But I think I’m just misunderstanding something. Can somebody unscramble this for me? Thanks very much!