Someone using my account to spam?

Brian Kennedy · 01-06-2006, 10:26 PM

All of a sudden, I have 200 delivery failure notifications from various domains. Someone put a return address of helen.liu@briankennedy.net on a spam e-mail.

What do I do? Please, please help!

Here is one sample e-mail I'm seeing returned to me:

Code:

Return-Path: <>
Delivered-To: info@briankennedy.net
Received: (fqmail 7337 invoked from network); 07 Jan 2006 00:02:00 -0000
Received: from mx10.futurequest.net (mx10.futurequest.net [69.5.6.182])
  by pt02.futurequest.net ([69.5.6.173])
  with FQDP via TCP; 07 Jan 2006 00:02:00 -0000
Received: (qmail 19723 invoked from network); 7 Jan 2006 00:02:00 -0000
Received: from pt02.futurequest.net (pt02.futurequest.net [69.5.6.173])
  by mx10.futurequest.net ([69.5.6.182])
  with QMQP via TCP; 07 Jan 2006 00:02:00 -0000
Delivered-To: helen.liu@briankennedy.net
Received: (fqmail 7332 invoked from network); 07 Jan 2006 00:02:00 -0000
Received: from mx09.futurequest.net (mx09.futurequest.net [69.5.6.181])
  by pt02.futurequest.net ([69.5.6.173])
  with FQDP via TCP; 07 Jan 2006 00:02:00 -0000
Received: (qmail 23355 invoked from network); 7 Jan 2006 00:02:00 -0000
Received: from mail.t-email.hu (mail.t-email.hu [212.51.125.49])
  by mx09.futurequest.net ([69.5.6.181])
  with ESMTP via TCP; 07 Jan 2006 00:02:00 -0000
Received: from mc1.mail.westel900.net (mc1.mail.westel900.net [172.17.4.65])
 by smtpgw3.mail.westel900.net
 (Sun Java System Messaging Server 6.1 HotFix 0.11 (built Jan 28 2005))
 with ESMTP id <0ISP001UD3WFYC90@smtpgw3.mail.westel900.net> for
 helen.liu@briankennedy.net; Sat, 07 Jan 2006 00:57:51 +0100 (MET)
Received: from process-daemon.mail1.mail.westel900.net by
 mail1.mail.westel900.net
 (Sun Java System Messaging Server 6.1 HotFix 0.11 (built Jan 28 2005))
 id <0ISP001013VNJY00@mail1.mail.westel900.net> for helen.liu@briankennedy.net;
 Sat, 07 Jan 2006 00:57:51 +0100 (MET)
Received: from mail1.mail.westel900.net
 (Sun Java System Messaging Server 6.1 HotFix 0.11 (built Jan 28 2005))
 id <0ISP00LGM3WFVDT0@mail1.mail.westel900.net>; Sat,
 07 Jan 2006 00:57:51 +0100 (MET)
Date: Sat, 07 Jan 2006 00:57:51 +0100 (MET)
From: Internet Mail Delivery <postmaster@mail1.mail.westel900.net>
Subject: Delivery Notification: Delivery has failed
To: helen.liu@briankennedy.net
Message-id: <0ISP00LGO3WFVDT0@mail1.mail.westel900.net>
MIME-version: 1.0
Content-type: multipart/report;
 boundary="Boundary_(ID_nQcfFcaRru1LUSt/QneL3w)"; report-type=delivery-status


--Boundary_(ID_nQcfFcaRru1LUSt/QneL3w)
Content-type: text/plain; charset=us-ascii
Content-language: en-US
Content-transfer-encoding: 7BIT

This report relates to a message you sent with the following header fields:

  Message-id: <ULTcaH.squirrel@62.168.97.100>
  Date: Sat, 07 Jan 2006 00:01:32 +0000
  From: Chu <helen.liu@briankennedy.net>
  To: mnorbert@westel900.net
  Subject: Lively Benefits of Creativity

Your message cannot be delivered to the following recipients:

  Recipient address: mnorbert@westel900.net
  Reason: Over quota


--Boundary_(ID_nQcfFcaRru1LUSt/QneL3w)
Content-type: message/delivery-status

Reporting-MTA: dns;mail1.mail.westel900.net (ims-ms-daemon)

Original-recipient: rfc822;mnorbert@westel900.net
Final-recipient: rfc822;mnorbert@westel900.net
Action: failed
Status: 5.0.0 (Over quota)

--Boundary_(ID_nQcfFcaRru1LUSt/QneL3w)
Content-type: message/rfc822

Return-path: <helen.liu@briankennedy.net>
Received: from ims-ms-daemon.mail1.mail.westel900.net by
 mail1.mail.westel900.net
 (Sun Java System Messaging Server 6.1 HotFix 0.11 (built Jan 28 2005))
 id <0ISP00LGM3WFVDT0@mail1.mail.westel900.net>; Sat,
 07 Jan 2006 00:57:51 +0100 (MET)
Received: from smtpgw2.mail.westel900.net ([172.17.4.210])
 by mail1.mail.westel900.net
 (Sun Java System Messaging Server 6.1 HotFix 0.11 (built Jan 28 2005))
 with ESMTP id <0ISP00I143WCWQH0@mail1.mail.westel900.net> for
 mnorbert@westel900.net; Sat, 07 Jan 2006 00:57:50 +0100 (MET)
Received: from mail.fullgreen.net
 (softbank219214044119.bbtec.net [219.214.44.119])
 by smtpgw2.mail.westel900.net
 (Sun Java System Messaging Server 6.1 HotFix 0.11 (built Jan 28 2005))
 with SMTP id <0ISP0050G3W92V60@smtpgw2.mail.westel900.net> for
 mnorbert@westel900.net (ORCPT mnorbert@westel900.net); Sat,
 07 Jan 2006 00:57:49 +0100 (MET)
Received: from 62.168.97.100
 (SquirrelMail authenticated user helen.liu@briankennedy.net)
 ; by mail.fullgreen.net with HTTP id J85Gz008873301; Sat,
 07 Jan 2006 00:01:32 +0000
Date: Sat, 07 Jan 2006 00:01:32 +0000
From: Chu <helen.liu@briankennedy.net>
Subject: Lively Benefits of Creativity
To: mnorbert@westel900.net
Message-id: <ULTcaH.squirrel@62.168.97.100>
MIME-version: 1.0
X-Mailer: SquirrelMail/1.4.3a
Content-type: text/html
Content-transfer-encoding: 7BIT
X-Priority: 3
User-Agent: SquirrelMail/1.4.3a

<HTML><BODY>
When it comes to corporate identity Creativity is vastly important. Leaving a lasting impression sets you apart from your competitors. Creativity from the very beginning - from Iogo and stationery design - helps to break through in the marketinq fieIds .lt is the way to be individuaI and unique and at the same time meet your customers' expectations, being catchy without beinq odd. This is our credo.<BR>
<BR>
We create onIy hand-made, oriqinal Iogos ,specialIy done to reflect your distinctive company image. We are sensitive to your needs, aims and preferences. We'll do the best of your ideas, or - if you don't have any - we'll simply do the best. In the shortest possible time. This is our way.<BR>
<BR>
Marketing break-through often makes gaps in your budget, but not this time. In addition to the affordability of our design, we provide really exclusive services: no extra fees are taken for revisions and you can be sure that you are buying the design, which you like, for a fixed price. And this is only one of our advantages!<BR>
<BR>
<A href="http://dzfdeagqnawcc.zolpat.com">Check the others!</a><BR>
<BR>
____________________________________________________<a href="http://J85Gz008873301.zolpat.com/">&nbsp</a><BR>
<A href="http://zlcmpqlrwzgtczjklcu.zolpat.com/">not interested...</A><BR>
</BODY>
</HTML>

--Boundary_(ID_nQcfFcaRru1LUSt/QneL3w)--

*sheila* · 01-06-2006, 10:32 PM

Brian, the original email in that bounce message never passed through the FutureQuest network at all. It appears that someone is forging your domain name in the sending address, as described in this Knowledgebase article:
Why does this spam look like I sent it?

Brian Kennedy · 01-06-2006, 10:38 PM

Thank you, Sheila. That is a relief.

I was thinking perhaps someone cracked into my e-mail account somehow.

I clicked the "delete" link on the e-mail manager and deleted them all (201 of them). I realize I probably should have saved a couple to investigate who it came from to report it. If I get a bunch more, I'll do that next time.