Spam title includes unusual words from my recent emails

Question

Occasionally, I get spam that includes in the subject line an unusual name or word that appears in other (legitimate) messages I recently received.

Perhaps a coincidence, I thought, until it happened twice in recent days with unusual words that the spammer, somehow, managed to pick from other messages.

This morning a friend sent me a message with "Raspberry" in the body. I had not used that word in about a year. And less than 2 hours later I got a spam message with the subject "Raspberry".

This is not a coincidence: somebody is reading my emails!

I am a PC professional, and I can attest that my PC has been fully tested and it looks absolutely free of any malware.

Could this be happening at the server level? My email is with a ISP who swears he has no problem.

Answer 1

A possible explanation is that the sender's machine is infected with some malware. When you receive an email from Bob, by definition, Bob's computer saw the whole contents; and also your email address. It seems easy, for some malware residing on Bob's computer, to send some spam with the same word, on the basis that you may be interested in the subject.

It is one of the dark points of spam: you get spammed because the machines and address books of other people are plundered by malware.

---

Another possible explanation is coincidence. You received an email with "Raspberry" in the body. But think of the millions of people who may also have received spams with "raspberry" in them while that had not used that word previously; and of the other millions of people who did send emails with "raspberry" in it, and yet did not receive spam containing that word. None of them posted in security.SE. Technical term is the anthropic principle: if you bring your attention only to seemingly "extraordinary" situations then you will see at lot of them, but not because they happen more often than predicted, only because you choose (more or less consciously) to disregard more "normal" occurrences.

My server keeps a copy of the last two weeks of spams that I receive and that my antispam filter automatically recognizes. That's, right now, 1170 spams (a figure which is not very big; around 2008 I was receiving more than 400 spams per day). Among these 1170 spams, one of them happens to use the "raspberry" word (as part of an email address), and that's not for my own using that word.

Answer 2

It is possible that your spam filter is using the content of your legitimate mails to train itself. When you receive an email with the word "raspberry" and didn't mark it as spam, the spam-score of the word "raspberry" is reduced. So an illegitimate email which also uses this word has a higher chance of going through.

Spammers use all kinds of words to oversaturate spam filters, so it isn't unlikely that you receive some with the that word every few days, they just got filtered until now.

Answer 3

Your ISP (and any hotspots) away, mail could also leak via:

• Your recipient's mail provider;
• Your recipient's ISP, including hotspots, etc.;
• Any relays mail go through;

Try to send mails including some unique yet buzzword subjects:

• To/from yourself;
• To/from another mailbox at your ISP;
• To recipient's mail provider mailbox from very same provider;
• Change your mailbox password and then perform the "buzzword" experiment (suggested by @Jor-el);

This may give you some glues on which side leak happens, should spam messages appear somewhere.

And don't forget to check activity log with IPs at your mailbox (consider changing E-mail provider in case you do not have this kind of report available).

Answer 4

Are you sure that this is indeed being leaked from your emails? Have you posted/rated or did some other action on forums/blogs or related sites that might indicate that "Raspberry" might be an interesting word for you? I'd guess that it's more probable that someone linked some online identity of yours to your email, and was able to figure out that "Raspberry" is an interesting word for you. Some time ago, I accidentally leaked my work email on an Android forum, and started getting spam with Android-related themes in the content/subject like.