How can I stop an account I don't control from sending spam email in my name to my contacts?

Question

Recently I received an email from a friend with "My" email to them attached. The email "I" sent them was obviously spam, one of those "You have to see this..." emails. The email had been sent to several people form my contacts list, but the email address sending the email was not my own, or one that I had ever owned. So of course I went through all of my email accounts, even my work email, and found no sent items matching the spam email that was sent. Because the email didn't seem to originate from any account that I owned I didn't see the point in changing the passwords on any of the accounts. It's my name, they are my contacts, but the account that sent the email is not mine. So obviously they have my name, and contacts, and have created this factious account and are sending spam to these people as me. I have no idea how to stop or prevent this?

I see my options as; Try sending an email to all of those people requesting that they block this email address that I don't own. Which would likely be categorized as spam its self, and possibly ignored. OR

Do nothing, and allow my friends to suffer more spam to their inboxes. OR

Email the false address, possibly confirming that the information they have is valid, resulting in who knows what.

The only kind of up side to any of this is that I know at least some of the addresses are so old that they no longer exist, but who's to say that the next time they won't use other contacts of people who actually exist, or that this isn't just the first wave and there will be more to come, possibly under a different email? I really feel stuck and frustrated.

After thinking about and writing this question the only way I can see this happening would be an app on a phone or device. Many of them want to access your friends, or contacts, which I'm always leery of. The one I'm usually most leery of are the ones who want to connect to my FB account. However none of these are from FB, they are all strictly email contacts, and I can't even narrow it down to one account because most of them I've shared with multiple accounts.

OK now I'm answering my own question, but I guess my next step would be to go through the names in the email, put each into one account until I come to one that doesn't auto suggest, when I find one that excepts them all I will have found my compromised account. Then I can cross reference that account with known apps, and sites that I've shared it with to try and find the culprit responsible.

Answer 1

Bear in mind that if you and your friends all have each other as contacts the email could have been sent from one of their systems and simply masqueraded as you. The from address in an email is very easy to spoof, so just because it says it is from you (or a made up address that has your name so that it looks like you) it does not necessarily mean it was actually sent by that address.

You could look at the email headers (or more accurately, unless your friend sent you the actual email itself and did not just forward the email as that would not preserve the headers, they would have to look at the headers of the original email on their side) to determine where it actually came from. This might let you narrow it down some to see if it came from to make sure it was not something like a virus sending out from your system(s) as you. You should at least be able to see the hops the email took (as shown in the Received lines in the header) to get an idea of the path it traveled. I would say that is a worthwhile exercise just to make sure that the origination does not show it coming from you system (which would then have me running virus scans to see if I have an unexpected visitor).

Lastly, if all the contacts in the email are indeed ones you have... then I would still change my passwords. The two primary ways that your contacts could be exposed (again assuming they were actually exposed from one of your accounts) are either based on something running locally on your system which was then able to gather your contacts, or by access to your account. That being said, I would make sure that there are no viruses running locally before changing your passwords... if there is you are just providing the new access to the existing virus.

I do also agree with the comment posted that says the damage is already done. If your contacts were extracted off your system, then they are already known by a spammer, so letting your friends know that the sending address was a bogus one would not hurt. This does not mean that next time the sending address could not be some variation of your name trying the same thing again. What can I say, spammers suck.

Answer 2

TL;DR, you can't.

The protocol behind email is quite primitive, and in many ways very closely mimics the meatspace postal system. Nothing stops me from dropping a letter in the mailbox pretending to be from someone else (although the postmark might indicate that the letter wasn't actually picked up from where the return address specifies).

That said, the situation has changed a bit in recent years. SPF has become more widely deployed, and allows a server receiving an email to verify that it's coming from a server authorized to send email from that domain. DKIM complements this by helping to ensure the contents of the message haven't been altered in-transit. So the best you can do at this point is to use an email provider that implements SPF protection for their outbound email, and hope that your friends use email providers that verify those records. That said, a spammer can still simply use your name in any email being sent, even if they're forced to use a different email address.