i believe someone "hacked" my email and sent 2 emails from my account without me knowing. I use outlook 2010, our email is hosted by rackspace. Everything points that i sent the 2 offending emails, even though i cant find them in my sent items in outlook. Whoever sent the mails, used the BCC fields to hide to recipients and all i can get out of our server host is them mails were sent from an android device. Which i do not have! Can anyone help? the message header i have from one of the recipients shows i did it, but i know i didnt.

  • 1
    The "from" field in email is meaningless. You can ask your mail provider to help you understand where to find the sending IP address in the header, but that still won't usually help you actually track down who did it. Instead, focus on changing to a strong password and not sharing it with ANYONE, and making sure that your computer is exploit-free. – Debra Jan 20 '14 at 20:33

Debra indicated the important things:

  • The sender e-mail address is very easy to forge. You cannot rely on it at all.
  • In the complete headers of the e-mail you can find at least the IP address of the machine which delivered the e-mail to the destination mail server.

If the deceiver was not clever enough you can possibly trace him from this information. It could be his address directly or could have used mail transfer agent which logged the sender's IP address and you can trace him.

You can find basic information about the tracing for example in the article How to Track the Original Location of an Email via its IP Address. The IP addresses of the sender/agents (there could be multiple intermediate agents in the path) can be found in the Received: header. Sometimes you can also find X-Originating-IP: header. Also the Date: header could help to determine at least the time zone of the sender/agent.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.