As soon as one machine is infected it will use windows shares to infect any other machine on the network that is vulnerable, without those users needing to do anything wrong. If you're un-patched anyone on the network gets infected you are infected.
HTH
Yes, that helped – thanks!
I had assumed that such a behavior would be common among worms; I guess Windows security must be generally better than I'd thought.