I have had a couple emails sent to people who have sent me an email in the past (in my inbox, but who are not necessarily on my contact list). They have my full name in the from section, and in the email body, but the email address they are sent from is not mine, nor do I recognize it. The emails were not sent from my email account, but it is alarming that they are sent to emails obviously linked to my account. And many are not related so I would not have sent an email to them all together in the past. How could somebody have gotten these email addresses from my account?
The actual attack vector is hard to guess at because there are so many options, but some possibilities are:
- A virus could have accessed your contact history or address book.
- A packet sniffer watched other emails go by if they were sent over a non-secure connection.
- Someone made some lucky guesses based on public information such as social media connections, work associations, common interests, etc.
- Any of the above could have happened to the other email accounts which had sent/received messages to/from you. If the association is found on either end, it would still work.
Now that it happened, you may also be wondering what to do about it. Here is a good answer I found on just that question, but the news isn't great.