I'm a technician working in pharmaceuticals. Corporate policy is that we lock our computers when stepping away, even for a moment. (Not that my department deals with anything private or sensitive, but still.)
We do this all the time. Mostly we use the corporate instant messaging client of the victim to send a potentially embarrassing message to someone else in the department. ('i luv you man!' is pretty common. Or proclaiming the greatness of a sports team the computer owner hates.)
There are a few (previously) unspoken rules:
1. Never send anything outside the department.
2. Never, ever, ever send anything to the boss. (Like 'I quit', for example.)
3. The message should be pretty obviously not sent by the computer owner.
4. The message recipient should always pick on, make fun of, and generally ridicule the computer owner / apparent sender.
5. Don't do anything permanent, non-obvious, or difficult to undo.
As you can imagine, our computer security is considerably better now than before we started doing this...