How should I react to finding GMail outbox e-mails that I didn't send?

Question

This morning I found 17 e-mails in my GMail outbox that I didn't send. The e-mails were sent to seemingly random people from my GMail contacts and contained the link to a suspicious php file on fabbricadeisogni2012.it. I checked activity on my account and found SMTP activity originating from some IP in NY which apparently is responsible for sending those e-mails. I warned all the contacts that received those malicious e-mail not to follow the link.

My questions:

1. Has my GMail password has been stolen?
2. Should I or can I report this activity to Google and/or any Internet security companies, communities, or government agencies?

Answer 1

Yes, it is extremely likely that your gmail password has been stolen. Those emails wouldn't be in your outbox if they hadn't been sent through google's smtp servers or mail API, and Google requires your credentials to send emails servers, so unless there's an unreported bug that allowed it your account has been compromised. You need to change your password, and any other accounts that use the same or a similar password.

You should also put some thought into how your account details have been compromised, and take steps to prevent it from happening again. It could be:

1. bad habits: you could have shared your password, written it down where it could be seen, typed it in where it could be seen, transmitted it unencrypted, chosen an easy to crack/guess password or used the same password on another site. You should do none of those things
2. Your computer was compromised: if someone's cracked your computer you will need to rebuild the OS from scratch, the "nuke it from orbit" solution as favored by @Polynomial
3. Google account information was compromised: this is the least likely, but still possible cause. If this is the case I'd expect it to come to light.

Answer 2

There is a chance that your password has been guessed by a bot. You should change your password as soon as possible and check the password recovery mechanism settings (phone number, security questions, alternative emails), to see if they were not changed.

You could report this activity to Google, but I don't think any other company or government agency would give it too much attention, as long as there is not too much harm done.

You should also try using Google's two factor authentication, beside using a strong password.

Answer 3

Assume the worst, change your password and anything that had the same password. It's up to you if you want to notify Google, though they likely won't care too much unless the fraudulent e-mails are reported to them as abuse by someone else.