To ease tracking replies and bounces, we send automated emails such as - order confirmations, password recovery, etc with a unique sender address typically like this FROM sup-[custno]-[invno]-[hash]@sup.ourdom.tld
Now I see failed login attempts to our IMAP-server, with these addresses. Each address is tried 6 times, from IP-addresses all over the world, China, Taiwan, Africa, South America, so it is obviously a botnet.
These addresses only exist in transit and on the recipients device, how could they be picked up by hackers? Do we inform the specific customers that somebody is reading their email?
Are we even allowed to send unsolicited emails to these customers, or can that be considered mails concerning transactions we have had with them previously?