A few months ago I configured a test mail server on Amazon AWS, all legit. I used a new address to my catchall-domain (something similar to, but not exactly, [email protected]).

I've now started getting spam mail to that very address. It is highly unlikely that a spammer would have 'guessed' that address. How might the spammer have gotten that address?

Note that I used the standard Ubuntu Server 12.04 LTS virtual machine as provided by Amazon. The server was on a special testing Security Group (like a hardware firewall in Amazon Web Services) which allows world access to ports 25 (legacy SMTP), 80, 443, 465 (SSL SMTP), and 587 (SMTP) but no others. Specifically, ports 22 (SSH), 993 (SSL IMAP) and everything else is accessible only from the IP address of our office.

Additionally, the computer used to send and receive from the test server is a Kubunu Linux machine, thus I doubt that the machine itself was infected with malware. All mail was sent and received in Thunderbird, so a compromised browser plugin also seems unlikely.

I suppose that the mail might have been intercepted in transit. Though most of the testing was done over SSL, there were at least two emails downloaded over IMAP on port 143 without SSL. Is this the most likely attack surface? Am I disregarding other potential attack surfaces?

A few months ago I configured a test mail server on Amazon AWS, all legit. I used a new address to my catchall-domain (something similar to, but not exactly, [email protected]).

I've now started getting spam mail to that very address. It is highly unlikely that a spammer would have 'guessed' that address. How might the spammer have gotten that address?

Note that I used the standard Ubuntu Server 12.04 LTS virtual machine as provided by Amazon. The server was on a special testing Security Group (like a hardware firewall in Amazon Web Services) which allows world access to ports 25 (legacy SMTP), 80, 443, 465 (SSL SMTP), and 587 (SMTP) but no others. Specifically, ports 22 (SSH), 993 (SSL IMAP) and everything else is accessible only from the IP address of our office.

Additionally, the computer used to send and receive from the test server is a Kubunu Linux machine, thus I doubt that the machine itself was infected with malware. All mail was sent and received in Thunderbird, so a compromised browser plugin also seems unlikely.

I suppose that the mail might have been intercepted in transit. Though most of the testing was done over SSL, there were at least two emails downloaded over IMAP on port 143 without SSL. Is this the most likely attack surface? Am I disregarding other potential attack surfaces?

EDIT: Adding some information to answer comments.

1. The server (actually virtual machine running in Amazon's cloud AWS) was created, tested, and decommissioned all in a single workday, from images (virtual appliances) from Amazon. I find it highly unlikely that the server image was compromised as I use the same image on other servers, and it happens to be one of the most common Amazon server images (Ubuntu Server 12.04 64-bit).

2. The email address was never exposed via Apache. In fact, I don't remember even having installed Apache on the box, though it is possible that I did. In any case, I certainly did not perform any Apache configuration such as setting the email address for "contact admin".

3. The only email sent via the machine were a few test emails to the account in question from my regular email account in Thunderbird, and a few replies to those emails (also done in Thunderbird). Mails were sent and received both via SSL-secured and unsecured connections (SMTP and IMAP).