Emails sent out to contacts with phishing links

[goombawaho]

I wanted to confirm the troubleshooting steps when someone has their contacts telling them they've been sent an email with a phishing link in it.

1. Malware on computer sending the emails from the PC. Evidence: No emails in SENT folder
2. Webmail password hacked and emails actually sent from the account Evidence: Emails in SENT folder
3. Spoofing of email address Evidence: No emails in SENT folder AND lots of undeliverable returns

Any other troubleshooting advice?? Probably "full email headers", I'm guessing.

 

[goombawaho]

I found a good link.

http://www.richpasco.org/virus/hacked.html

Plus there are online email header analysis tools. I would change your email address before pasting the header in these tool, just in case.

http://www.gaijin.at/en/olsmailheader.php