Dozens of email delivery notifications

Irish Stones

In the last weeks I keep on receiving notification of unsuccessful message delivery to email addresses that I don't know. I receive up to 40 message at the same moment as I had mail-bombed around to non-existing email addresses.
The errors attached to these notifications are 5.3.0 , 5.1.1 and 5.1.2.
The strange thing is that I only receive those notifications via my email client (Thunderbird 24.6.0) but there's no trace of them in the webmail page.
The time of that notifications is most often when my PC is off, so it's as the emails were sent by someone else.
Is there something I can do to understand what is going on?
Thanks!

Mr. G

Not all email providers send back bounce emails to the receipient, instead send alerts saying it was undeliverable, not accepted etc. Is this an Exchange/business server perhaps? In that case, it may have been set up not to send bounce emails to prevent spamming in a method called back-scatter.

Check your Junk folder for bounce emails too.

Codes outlined here:
http://www.coldnet.net/tech/SMTPCodes.htm

Odd about the 5.3.0, surely you mean 5.1.0?

Irish Stones

Mr. G wrote: »

Not all email providers send back bounce emails to the receipient, instead send alerts saying it was undeliverable, not accepted etc. Is this an Exchange/business server perhaps? In that case, it may have been set up not to send bounce emails to prevent spamming in a method called back-scatter.

Check your Junk folder for bounce emails too.

Codes outlined here:
http://www.coldnet.net/tech/SMTPCodes.htm

Odd about the 5.3.0, surely you mean 5.1.0?

The unsuccessful delivery notifications come from different servers, like GMail, AOL, Hotmail, Comcast, Verizon, Yahoo, MSN, but also from private servers.
Here some examples of messages (addresses have been masked):

xxxxxx68@msn.com; Failed; 5.3.0 (other or undefined mail system status) Remote MTA mx2.hotmail.com: network error

kkkkkkk@yahoo.com; Failed; 5.3.0 (other or undefined mail system status) Remote MTA mta6.am0.yahoodns.net: network error

jjjjjjjjj20@msn.com; Failed; 5.1.1 (bad destination mailbox address) Remote MTA mx1.hotmail.com: SMTP diagnostic: 550 Requested action not taken: mailbox unavailable

eeeeeeee@comcast.net; Failed; 5.1.2 (bad destination system address) Remote MTA mx2.comcast.net: network error

Xxxx.Yyyyyy@flextronics.com; Failed; 5.1.1 (bad destination mailbox address) Remote MTA cluster1.us.messagelabs.com: SMTP diagnostic: 550-Invalid recipient <Xxxx.Yyyyyy@flextronics.com>\r\n550 (#5.1.1)
df

Nate--IRL--

Somebody is spoofing your address, as the return address, as they send out spam.

Not much you can do really.

Nate

Irish Stones

Nate--IRL-- wrote: »

Somebody is spoofing your address, as the return address, as they send out spam.
Not much you can do really.
Nate

Oh, that's bad news...
Do you think that there's a way to trace who is using my address?

Nate--IRL--

Not that I know of.

Nate

Polar Ice

You should change your email password, just as a precaution

Irish Stones

Polar Ice wrote: »

You should change your email password, just as a precaution

Yes, I could, though I don't see how it can help.
The mails to those addresses don't generate from my computer. Generally the notifications are in times that my PC is off and they come in bunch of 20 to 40 all at the same time.
Between last night and this morning I had about 60 notifications, half of them at about 11 pm and the other half at about 8:30 am this morning. I switched the PC off at 8 pm and I turned it on this morning at 11:30...

Polar Ice

Irish Stones wrote: »

Yes, I could, though I don't see how it can help.

A precaution.
It's not going to harm

Irish Stones

Polar Ice wrote: »

A precaution.
It's not going to harm

I followed your tip, and after a month without notification spamming I can tell you that it worked!
So, it's likely that someone had breached the security of my password and used my account to spam around the world.
Thanks!

Snowbat

It may look that way but spammers change spoofed Return-path addresses frequently, typically changing to a new one for every spam run.

Many of the earlier bounces likely included the headers (Received: from lines) of the original. If you examine these headers, you will see the source IP address and network. If it did not come through your ISP, your account was not used. Feel free to PM me some headers if you need help deciphering them.