If your machine is on the internet it is hackable.
Its kind of like if you build a house, somebody can break and in and rob your stuff.
Your job is to make it as difficult as possible for them to come in. IM products are pretty much insecure because they really don't care about your security. The only reason they patch bugs is for
PR. Most DoD installations do NOT allow IM products for this reason.
Best bet is to only IM people you know.. but of course that takes out some of the fun..
Do beware of who you're talking to though, and DEFINATELY have a software firewall installed!
www.sygate.com is my preference