I have a weird problem that I hope you good people might be able to help me with.

It's recently come to my attention that emails are being sent to my iPhone contacts, but not with my actual email address.

The email addresses basically look like "[email protected]" not exactly that, but you get my point. It's just spam that is contained in the emails.

So I'm guessing my apple account has been compromised or is it something else and how can I fix it.

Your contacts got leaked. In the world of smartphones that is as simple as installing a malicious app and granting it permissions to your contacts. It's possible that your account got compromised, but the contacts route is easier

Not anything you can do either. They know your name and know your contacts. The best you can do is just inform people.

Well at least it isn't my apple account that's been hacked. I changed the password for it anyway.

It's weird because I haven't downloaded anything that out of the ordinary and I usually deny apps access to my contacts unless that's the explicit purpose of it. Which it rarely is. It's only 3 email addresses that have been leaked anyway.

Still very frustrating. 馃檮

If your apple account had been hacked, most likely they'd spam from the account directly rather than using an alternative email address. They'd also have reset some of your other accounts through it using password reset features. That's why I doubt it's hacked. Changing your password just to be safe isn't a bad idea either.

It also could have been a facebook/twitter/etc app since many of your contacts are also there.

It isn't necessarily your contact list that has been leaked. If one of your contacts has had their contact list compromised, and if you are on that list, then somebody may be just using names from that contact list to send spam to others.

That could be possible.

There's a few people receiving similar emails from people they know.

I run a couple of mail lists (email-based discussion groups), and we run into this sort of thing all the time. Email isn't secure, and there's no way to keep people from clicking on links, so sooner or later you end up as a "contact of a contact of a contact" on somebody's compromised list.

The best I can suggest is to use meaningful subject lines, and get your friends to do so, too. That way, you can be reasonably sure whether an email is legitimate or not. And, of course, pay attention to the actual addresses, as you noted in your original post.

One tip for keeping track of your emails to see if they've been hacked is to insert into your contacts a fake address that looks legit.

If you find bounces, you've got a problem.

Any chance it'll eventually die down, once they come to the conclusion that it's a waste time because no one is clicking the links. Even if it's automated it's still a waste of time.

Even without having my contacts compromised I guess there's still nothing stopping them from sending spam to people. It's just annoying that it looks like I'm sending them. :/

If it makes you feel better I'm getting spam from what appears to be my own gmail account.

I've looked at the headers and can't find anything out of place on them, I've changed the password and enabled two step authentication, yet keep getting them.

And had a password reset for my Walmart.com account last night. Second one now. I'm not requesting them.

If the mail server on the receiving end isn't doing a reverse name lookup on the IP address of the SMTP relay to validate the sender, it's entirely possible that the spammer is just spoofing the sender address. The "from" and "reply-to" address data in the e-mail are being set by the mail client, so without any protections or validation in place there's nothing stopping a spammer from putting whatever they want as the "from" address. That said, most mail services these days will do a reverse lookup, and if the IP address doesn't match the sender's domain, will flag the message as spam.

Yep, happens.

A while ago, my sister's email was used to send Viagra ads to all her random contacts, which of course was embarrassing. But the best response was her 20 yr old son replied to her, saying "Mom, thanks for your interest in my well-being regarding whether or not I can achieve a sufficient... status for sixual encounters. But I think I'm pretty okay in the department for now. I appreciate your looking out for me though and if I ever need discount pharmaceuticals, I will check with you first. Love, your son."

That's priceless!