A few times now, I've received emails from contacts with subjects along the lines of "hi!" and message bodies of only a link to some website. I've checked the ip of the sender of these emails, and it's always a verified sender from their email provider. My assumption here is that something found their password and is using it to log in and send emails from their email provider.

I have always assumed my passwords are secure and that, were emails to be sent from my address, I would see them in the "sent" folder. I hadn't put much thought into that idea, so it only occurred to me today that the spambot could just delete the email from the sent folder.

How do I know if my email account's password has been compromised and is being used to send spam emails?

  • Where do you have your email hosted exactly?
    – sup
    Commented Feb 27, 2013 at 22:21
  • @Joel, Personally, Yahoo and Gmail, though I'm hoping for some advice agnostic of the email provider.
    – mowwwalker
    Commented Feb 27, 2013 at 22:29
  • Service providers do it a bit differently, so agnostic may not be possible. Also your assumption may or may not be true.
    – Rory Alsop
    Commented Feb 27, 2013 at 22:32
  • @RoryAlsop, Could you elaborate on how else it might be done? I'm also curious about that.
    – mowwwalker
    Commented Feb 27, 2013 at 22:33
  • Read security.stackexchange.com/q/4887/485 and security.stackexchange.com/q/1601/485 - do either of these answer your question?
    – Rory Alsop
    Commented Feb 27, 2013 at 23:21

1 Answer 1


Generally speaking I don't believe there will be an easy foolproof way of detecting whether or not you've been sending out messages given the access you typically have to a web based system (be it Yahoo, Gmail etc). If you had access to the server certainly you could through logging, but not with the information given to us via these clients.

Here are some suggestions through.

  1. Keep an eye on your login IP's if your client provides the capability of doing so. This can flag an attacker logging in from a location you've never been, hence raising the possibility of being compromised.

  2. Education - ask your friends / family to alert you to any strange messages such as the ones you've recieved in the past. The majority of the time I imagine if you're getting this stuff sent out you'll get a few replies from people going "Huh?"

  3. If you really wanted to you could create a honeypot email. Go sign up for some random email and place it no where else but your contacts in your email. An attacker would almost certainly send messages to everyone in your contact list, not knowing who is legitimate and who isn't. If Mr Smith recieves an email from you, you know your account has been compromised.

  4. Prevention is the best cure, make sure you'll changing passwords regularly and avoiding using the same password at multiple sites.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .