Are my emails being hacked?

Question

I receive a lot of emails from the Mailer Deamon. It says that it could not deliver a message I tried to send. But I did not try to send anything.

I have an email address that is forwarded to another email of mine.

my_g[email protected] => my@email_adress.com

The message I get is:

This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its recipients. This is a permanent error. The following address(es) failed:

my@email_adress.com

Reason: multiple delivery attempts failed

--- The header of the original message is following. ---

Received: from avahost.ru ([212.146.244.254]) by mx-ha.gmx.net (mxgmx010 [212.227.15.9]) with ESMTP (Nemesis) id 0MUkzE-1hagMe3Fgi-00YDne for my_gmx_address_that gets [email protected];
Sat, 09 Mar 2019 16:21:12 +0100
Received: by avahost.ru id hgfcvm16lt04 for [email protected];
Sat, 9 Mar 2019 10:21:31 -0500 (envelope-from [email protected])
X-Gm-Message-State: APjAAAUkA/Z1I9rvxQjR2IwB+xhH+t4WVmeDzO3RXwx8CJmixgVAbYkF KqnpLS/6uWAQZ4mLCg+EMNfXFVda
X-Google-Smtp-Source: APXvYqxVUsl5ekebDKnZxNP6iX4SYD9/aUscnS4oYGSYIlnDjaOC6TMp4Z/yfsA6MXFYNUNK6VRtYcMDtLpXtkBHDolo
MIME-Version: 1.0
X-Received: by 2002:a0c:945c:: with SMTP id i28mr613047qvi.57.1551766778742; Mon, 04 Mar 2019 22:19:38 -0800 (PST)
X-Notifications: jk8qs8bxywg3fwhrxpb
Message-ID: [email protected]
Subject: Gewichtsverlust von 10-12 Kg binnen eines Monats
From: Kundenservice [email protected]
To: [email protected]
Content-type:multipart/mixed; boundary="---- =_Part_121592_659013478.1551797199159" Envelope-To: [email protected]
X-GMX-Antispam: 6 (nemesis text pattern profiler); Detail=V3; X-UI-Loop:V01:6afBCUOQJQ0=:u9DWyWBBaWAqM42eHRSUdgN4rZA148QSv0SckM/3wjM=

The message content is always different but one thing is always the same:

To: [email protected]

What is going on here?

Answer 1

Probably one of your clients got its password stolen and tried to spam or send info toward that address. Password reset for that client usually solves this.

Technically, there are scripts that can interact with weak e-mail clients (like outlook) credential storage. They get the password and then can send a lot of messages to whoever they want (usually predefined lists) until external filters trigger and your whole server starts getting rejected e-mails due to low reputation or blacklisting. If the user clicked a one-time script, resetting the password of the account prevents further spam, but if the infiltration was more elaborate you will also have to do serious anti-virus and anti-malware checks on the affected system.