I've just emailed our some spam?

[gofes]

Hello

I just received an email to my isp (tiscali/ talktalk)
from an old email address I had with 1&1

I've checked the webmail and there is nothing in the sent items.
I have the email set up on Thunderbid (ubuntu) but nothing in the sent here either

Any idea how this happened, and what I should do to stop it (other than chanign the password) as I guess my whole address book got spamed.

Date: Thu, 7 Apr 2016 01:34:27 +0300
Subject: Fw: new message
Message ID: <0000ce9ce7bd$7d6150f0$2c898e3b$@thefuries.co.uk>
User agent: Microsoft Outlook 15.0

Received: from cm11gb1 (62.24.139.125) by mail.svcgb1.int.opaltelecom.net (8.6.141.03) id 56F18A5600D4A7BF for xxxxx@tiscali.co.uk; Wed, 6 Apr 2016 23:34:53 +0100

Received: from mail.mymts.net ([69.168.103.60]) by mx.talktalk.net with SMTP id nw2Ga8n6b2Qy3nw2Ga0KVJ; Wed, 06 Apr 2016 23:34:53 +0100

Received: from [88.237.180.37] ([88.237.180.37:59110] helo=wajds.com) by mail.mymts.net (envelope-from <ben@thefuries.co.uk>) (ecelerity 3.6.6.45965 r(Core:3.6.6.0)) with ESMTPSA (cipher=DHE-RSA-AES256-GCM-SHA384) id A7/5E-01002-90F85075; Wed, 06 Apr 2016 18:34:51 -0400

[peterb]

It's spam with forged headers. Delete it.

[gofes]

Yes, I sure it wasn't sent from my system, but how did they get hold of the contacts to send it to?

[peterb]

Either your contacts database has been raided, or a company/individual who deals with your company has been raided.

While the headers and from address can be forged, the actual path the email takes is likely to be genuine, so some careful work analysing that may confirm that it wasn't malware in your system that sent it. The problem is that once those addresses are in the wild, they can be used by a number of spam bots to send similar messages.

It's counter productive for the spammers, because if you get (say) ten identical messages from ten different sources, it's obviously spam, but the spammers are spraying out thousands of these, and if one random one ends up in (say) an accounts department, they may get lucky. Or if the payload is malware, they only need a very low success rate to make it worthwhile.

They only have to get lucky once, the recipients need to be vigilant all the time.