Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Recently a friend told me he had been sent spam from one of my email addresses, and today I got bounced spam which had that email address as recipient. This email address was connected to MSN Messenger a very, very long time ago. The domain is one of my private domains.

What makes me think that this is not just a spoofed sender is this line in the headers that I got in the bounced email:

Sender: <>

Does this mean that someone is sending the spam using Windows Live (via SMTP) and Windows Live helps them spoof the sender? If so, would removing my account from there (which I don't use anyway) help?

Received: from mail by with spam-scanned (Exim 4.69)
    (envelope-from <MYADDRESS@MYDOMAIN>)
    id 1SWmZr-0006hD-TF
    for; Tue, 22 May 2012 06:44:32 -0400
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on
X-Spam-Level: *
X-Spam-Status: No, score=1.1 required=4.5 tests=DATE_IN_PAST_06_12,
    MSGID_FROM_MTA_HEADER,RCVD_IN_DNSWL_NONE autolearn=disabled version=3.3.2
Received: from ([])
    by with esmtp (Exim 4.69)
    (envelope-from <MYADDRESS@MYDOMAIN>)
    id 1SWmZr-0006hA-Mj
    for; Tue, 22 May 2012 06:44:31 -0400
Received: from BLU0-SMTP66 ([]) by with Microsoft SMTPSVC(6.0.3790.4675);
     Tue, 22 May 2012 03:44:31 -0700
X-Originating-IP: []
X-Originating-Email: [MYADDRESS@MYDOMAIN]
Message-ID: <BLU0-SMTP6657BD341A29BE1A60A863B0020@phx.gbl>
Received: from [] ([]) by BLU0-SMTP66.phx.gbl over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675);
     Tue, 22 May 2012 03:44:30 -0700
Subject: RE: rich Dawe
Date: Tue, 22 May 2012 03:44:16 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-OriginalArrivalTime: 22 May 2012 10:44:31.0610 (UTC) FILETIME=[DEB765A0:01CD3807]
Sender: <>
X-Virus-Scanned: Tested OK
share|improve this question
up vote 1 down vote accepted

The mail appears to have originated from TurkTelekom ( and was accepted by a host in a range owned by Microsoft. None of the servers before accept email so they appear to routed internally by Microsoft. It does not appear that the address was spoofed.

It would appear that a Live user has set your address as the address to use when sending email. I would report this to where it should be addressed and include the headers you have above with your real address left in. I usually forward the full message including the headers. It is possible that does not have an abuse user in which case you will need to check their help information for the appropriate procedure.

share|improve this answer

Another thing that may have happened is that someone hacked your Hotmail account. Spammers often hack existing accounts to use for spamming because messages from existing, active account more easily get through since they have already been seen and may even have exceptions. There are a couple of things you will want to do.

  1. Change your password to something much harder to hack. If you have a simple password, it will be easy to hack your account (it happened to one of my Hotmail accounts that had what I thought was a decent password).

  2. Check your webmail’s sent folder. If there are indeed messages sent from your account, then you were definitely hacked (I saw three messages in mine). If not, then they may simply have used your address in the spam (this used to be quite common).

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .