Over the weekend at least three of my wife's email contacts received a spam message sent from her name and the user part of her email address, but a different domain name. The spam messages look like:
From: email@example.com To: <Friend> firstname.lastname@example.org Hi Friend http://spam.link Friend email@example.com Sent from my iPhone --- El software de antivirus Avast ha analizado este correo electrónico en busca de virus. https://www.avast.com/antivirus This email has been protected by YAC (Yet Another Cleaner) http://www.yac.mx
It's clear that her email contact list has been accessed in some way. It doesn't look like the spam is being sent from her account, just that here email address and contacts are being used.
We were in Dublin airport at the weekend and did use the free wifi there, but I assume that as she accesses her email through the standard Yahoo Mail iPhone app that it was secure.
We have immediately changed her email password. Is there anything else we can do to try and determine the source of this leak?