Recently my contact list was shared through some emails recently sent from my account. I would like to find out who did this as it has caused me some financial loss.
When I look at the email header, it looks exactly like my IP address but I know I didn’t send it. How can I identify that it wasn’t me and find out who did it?
How can I prove that the IP address was spoofed/faked? What can I try doing on my own before contacting a professional?
I’m using a Hotmail account.
You either had
The attacker likely didn't spoof anything ... they probably control your Hotmail account. If Hotmail has a screen that shows you recent logins you may be able to see where the attacker is logging in from but that won't help much.
Instead you need to
Any header can be forged in a mail - simply it is not possible to forge all at the same time. I am really surprized that the IP address has been forged, usually only the email addresses are.
As for who did that and/or where, it is impossible to answer without more details. The common way for that kind of investigation is to analyze the full headers and try to establish which MTA were involved. If all are under control (belonging to your organization), you could have more infos from the logs of the first one in the chain.
If all are trustworthy (belong to well know organizations) you could find the IP address of the sender. But in the vast majority of case, you end on various relays and need a legal action to obtain the informations.
Anyway, faking a sender email does not even require the corresponding password...
To directly answer your question, it depends on your knowledge. It you know enough of the SMTP protocol to seriously examine the headers, you may find evidences that the mail has been forged and use them to try to prove that you have not sent them. If you do not and asked for a simple workthrough, I am afraid that no exists and you should first find an expert in SMTP and then eventually a lawyer.
