Spam emails went out for an hour earlier this week bearing my Yahoo account in the FROM field and going out to all my contacts.
I changed the password, then saw (via rejected emails sent to my Yahoo account) that mail had gone out again with my email in the "FROM" field, to all my contacts.
However, in neither case did the account show to be accessed (verified in the Yahoo web client), nor did the account have anything in the sent folder of the account.
So I looked at the headers, and the last "Received" marker before the FROM looked suspicious, leading me to believe that my account is no longer able to be accessed, but with my full contact list, the spammers can now impersonate me and send out mail to my contacts.
Two of the headers' "Received" markers are shown below:
The "FROM" marker in each is my Yahoo account, email@example.com
Received: (qmail 9004 invoked by uid 0); 27 Feb 2014 06:16:28 -0000 X-TCPREMOTEIP: 18.104.22.168 X-Authenticated-UID: firstname.lastname@example.org Received: from unknown (HELO monahanlaw.com) (email@example.com@22.214.171.124) by 0 with ESMTPA; 27 Feb 2014 06:16:27 -0000 From: "Rob Lastname" <firstname.lastname@example.org**>
This is the second:
Received: from [126.96.36.199] (helo=mst-music.ch) by box6.rapidenet.ca with esmtpa (Exim 4.80.1) (envelope-from <email@example.com>) id 1WIvxj-0003Jw-Rn; Thu, 27 Feb 2014 03:05:00 -0500 From: Rob Lastname <firstname.lastname@example.org>