Yes, kazaa has quite a bit of spyware. It comes with cydoor (or whatever the hell its called), which gathers info about you and your searches etc.

However, the main concern of Kazaa is a program it comes shipped with called BDE. BDE allows your CPU resources to be utilized by the company that shipped it (forget what its called). A hacker could easily take advantage of this.

The best defense is to uninstall kazaa, run ad-aware, and then run BDE/B3D killer to get rid of BDE.