Module 3 · 3.4

English ▾

Nederlands English Deutsch Français Español Italiano

Passwords and a misused email address: hacked or spoofed?

Module 3: Managing your mailbox · Reading time: 10 minutes

Learning objective: After this lesson, you can properly secure your mailbox, recognise the difference between a spoofed sender and a hijacked mailbox, and take the right steps for each.

Key concepts: strong password, passphrase, password manager, reuse, data breach, brute force, IP block, two-factor authentication, app password, phishing, spoofing (forged sender), backscatter, hijacked mailbox, suspicious rules and forwarding, sending limit

Two kinds of "my address is sending spam"

Almost every administrator hears it sooner or later: "spam is going out from my address". There are two very different causes, and the approach differs.

1. Spoofing: nobody was in your mailbox

A sender address is just text. Anyone can send a message with From: info@example.com, via their own server, without ever getting into your mailbox. This is called spoofing.

Here's how to recognise it:

You suddenly get dozens or hundreds of bounces about messages you never sent, often to unknown addresses. This is backscatter: the recipients rejected the forged mail and sent the error message to the address shown in it, which is you.
Your own Sent folder shows nothing.
In your mail server's logs (in many panels: a feature like "e-mail tracking") you don't see these messages as outgoing mail.
In the headers of such a returned message (lesson 1.5) there's a Received line from a server that isn't yours.

Changing your password doesn't help here: nobody had it. What does help is DMARC (lesson 4.4). With p=quarantine or p=reject you tell recipients to quarantine or reject mail that doesn't pass your SPF or DKIM. That means the forged mail arrives less often, and fewer people are scammed using your name. The bounces usually stop by themselves after a few days; you can just delete them.

2. A hijacked mailbox: someone has your password

If someone has your password, they log in to your server and genuinely send spam through your mailbox. This is much more serious: the spam comes from a trusted server with your valid SPF and DKIM, so it often gets through. And the server loses its good reputation (lesson 5.2).

Here's how to recognise it:

In the server's log you see outgoing mail that you didn't send, often in large numbers.
The number of messages sent from your mailbox is much higher than usual, or you suddenly hit the sending limit.
Your provider reports it, or blocks sending.
Your mailbox contains things you don't recognise: a forwarding rule to an unknown address, a filter that immediately moves certain mail (for example from your bank or your provider) to the bin, a different reply address (Reply-To) in your settings, or an out-of-office message.

These rules are a well-known trick. An attacker who hijacks your mailbox often wants to read along unnoticed for a long time, for example to send a fake invoice with a different account number at just the right moment. A forwarding rule to their own address keeps working, even after you've changed your password.

How does someone get your password?

Phishing: a fake email with a link to a copied login page ("your mailbox is full, log in here"). The most common cause.
Reuse: you use the same password on an online shop or forum, and that gets hacked. The stolen combinations of email address and password are then automatically tried out on mail servers. With services like Have I Been Pwned you can check whether your address appears in a known data breach.
Guessing: short or obvious passwords (Welkom2026!, the company name) are guessed with brute force: thousands of attempts in a row.
Malware on your computer that intercepts passwords or pulls them from your browser.

Securing your mailbox properly

A long, unique password per mailbox. Length matters more than odd characters. A passphrase of four or five separate words is strong and easy to remember. Don't use it anywhere else.
A password manager. Then you don't need to remember all those passwords, and reuse is no longer necessary.
Two-factor authentication wherever possible. For business cloud mail (Microsoft 365, Google Workspace) and in your provider's client panel this is usually available. With a regular IMAP mailbox it often isn't possible for IMAP and SMTP themselves, because mail programs only send a password. Some services then use app passwords: a separate, long password per program, which you can revoke without changing your main password.
Be careful where you log in. Only enter your password in your own mail program or on the genuine address of your webmail. A provider never asks for your password by email.
Know your server's security. Many servers block an IP address after a number of failed login attempts. This protects against brute force, but it also means that an old device with the wrong password (an old tablet, a printer that scans to mail) can get your entire office network blocked.

What to do if your mailbox has been hijacked

Do this immediately, in this order:

Change the password in your provider's panel (not via a link from an email). Choose a new, unique password.
Check forwarding rules, filters, aliases and the out-of-office message, both in webmail and in the panel. Remove anything you didn't set up yourself.
Check which devices and programs are connecting and enter the new password everywhere. A forgotten device with the old password can get your IP blocked.
Scan your computer for malware, especially if you didn't click a phishing link.
Change the password elsewhere too if you reused it, and also the password of your client panel if it was the same.
Report it to your provider. They can see what was sent, clear the queue and lift a block.
Warn your contacts if mail was sent to them, especially in the case of fake invoices. A data breach involving personal data may also require a report to the privacy regulator in your country under the GDPR; check this if in doubt.

A hijacked mailbox rarely stands alone. Also check whether your website is sending spam: an unsecured contact form or a hacked plugin can also send mail in your name (lesson 7.3).

In practice: what this looks like in a panel

In DirectAdmin you change a mailbox's password under E-mail Accounts, via the three dots and Change Password/Username; the Sent column shows how much mail a mailbox sent today. With E-mail Tracking you can see whether a message was actually sent through the server. Forwarding is found under Forwarders, out-of-office messages under Autoresponders, and in webmail under Settings. Other panels have similar features, often with names like "message trace" or "mailbox rules".

Summary

Bounces about mail you didn't send, with nothing in your Sent folder: spoofing. DMARC helps here, not a new password.
Genuine outgoing spam in the server log: a hijacked mailbox. Change your password, check rules and forwarding, update devices, inform your provider.
Attackers often set up a forwarding rule or filter so they can keep reading along.
Use a long, unique password per mailbox, a password manager, and two-factor authentication or app passwords wherever possible.

Quiz

1. You get hundreds of bounces about messages to unknown addresses. There's nothing in your Sent folder or in the server log. What's probably going on? Your mailbox has been hacked
Someone is using your address as sender via their own server (spoofing)
Your mailbox is full
Your SPF record has disappeared

The mail never went through your server. You're only seeing the error messages (backscatter). DMARC set to quarantine or reject helps.

2. After a phishing email, you change your password. A week later the attacker still seems to be reading your mail. What have you probably forgotten? Adjusting your SPF record
Removing a forwarding rule or filter that the attacker set up
Changing your MX record
Making the mailbox bigger

A forwarding rule keeps working after a password change. Always check rules, forwarding and the reply address.

3. Why can an old tablet with the wrong password cut off your whole office from email? Because the tablet deletes the mailbox
Because the server blocks the IP address after too many failed login attempts, and all the devices in the office share the same IP
Because the tablet uses POP3
Because the tablet fills up the quota

Brute force protection looks at the IP address. Update the password on all devices.

4. Which measure best protects against reuse of a password that was leaked from another website? A new password every month that resembles the old one
A unique password per service, stored in a password manager
A password with an exclamation mark at the end
DMARC set to reject

A leaked password is then useless anywhere else. DMARC helps against spoofing, not against logging in with a stolen password.

Exercise

Exercise O3.4: Security check for your mailbox. Go through your own mailbox. Is the password unique and long, and is it stored in a password manager? Look up your address with a data breach service (such as Have I Been Pwned) and note whether it appears in a breach. Check all forwarding rules, filters, the reply address and the out-of-office message in webmail or the panel. Note which devices use the mailbox. Then answer: if you get bounces tomorrow for mail you didn't send, how do you work out whether it's spoofing or a hack?

Exercise O3.4: Security check for your mailbox

Don't enter any passwords. Check for yourself (for example at Have I Been Pwned) whether your address appears in a data breach; we never send your address anywhere.

My password is unique and at least 15 characters, or a passphrase.
It's stored in a password manager.
Two-factor authentication or an app password where possible.
I've checked whether my address appears in a data breach.
No unknown forwarding rules, filters, reply-to addresses or out-of-office messages left.
All devices are using the current password.

How do you find out whether bounces for mail you didn't send are spoofing or a hack?

Also save my answers in My courses (so you can view and download them on any device). Don't include any passwords or other secrets.

Here's how you could approach this

Check Sent and the server's log (email tracing). If the message isn't there and the Received line in the returned mail comes from an unfamiliar server: spoofing (tighten DMARC, discard the bounces). If it is there, or you're sending far more than usual: a hack (change the password via the control panel, remove rules and forwarding, update devices, scan your computer, inform your provider, warn your contacts, check your GDPR notification duty).

Your ticks and notes only stay in this browser; we don't send them anywhere. If you're signed in, we only save in My courses that you've done the exercise.

Cookies at WebOké

Cookie settings

Necessary

Marketing