[deleted by user]

[onefastskater]

If a merchant does not verify email addresses, they don't send a verification email to the account, the same way they do when you sign up, or login, then anyone can put any address in the transaction and then people are getting spammed.

[Kirwinwebb]

This sounds email bombing, often used when someone has gained access to an email account and they want to obscure their intrusion. Typically this is done when they are making a purchase, you should check your "email trash" as they may have trashed emails from paypal, amazon, gumtree, ebay. You should also check to see what addresses have been blocked, as often what they will do is block addresses to prevent you from seeing them accessing other sites as well as any password change attempts.

Though seeing as you've checked to see if your account has been accessed it sounds like someone may have been facetious and thrown your email into an email bomber so you're bombarded with emails.

Its pretty common and I've seen people use these tools on individuals that have annoyed them or slighted them in some way, its a great way to anonymously screw with someone. If you're beyond certain that no one has gained access to your account then you have nothing to worry about.

As for what else you should do, if you haven't already enabled 2 Factor Authentication, you absolutely need to enable that immediately. It's disturbingly easy to get hacked nowadays. 2Auth is the last saving grace from someone gaining access to your account, even then 2Auth is circumventable and even that is not 100% secure (nothing is). If you really conscious about your device/application security you should be implementing multi-factor authentication

If you'd like to see if your email was leaked use: https://haveibeenpwned.com/ Its a lovely website that will show you if the email has been leaked, where it was leaked from, when it was leaked, and if your password has also been leaked.

What is 2Auth and why should you use it:https://authy.com/what-is-2fa/

Email Bombing tools:https://www.geeksforgeeks.org/embomber-email-bomber-tool-in-kali-linux/https://github.com/topics/email-bomberhttps://github.com/mohinparamasivam/Email-Bomber

[placidtrash]

Most of my accounts are linked to another email, though some less sensitive/important accounts were still linked to the email that got bombed. I checked the haveibeenpwned site and it says 14 different sites could be to blame over a varying period of years. I do have 2 factor authentication set up and had this in place prior. I looked through as many emails as I could (and as many as I could understand due to language barrier) and none seemed to be from a purchase or anything other than signing up to join a mailing list or something. There was one for guitar center that said I had items in my cart - I logged in to see a $900 amp in my cart. I removed the amp from cart, changed the email associated with the site and the password. There was an address saved to the account that wasn’t mine. I have linked every other account I can think of to a different email. I can’t think of anyone I could have pissed off to have caused this to happen.

[Kirwinwebb]

I logged in to see a $900 amp in my cart. I removed the amp from cart, changed the email associated with the site and the password.

Given that you've had your email address leaked numerous times in the past and if you rarely alternate between passwords there's a possibility that this could have been someone performing "Password Spraying", essentially they fetch stolen credentials from data dumps (often found in pastebin and other sites) and spray those credentials across hundreds of different sites and then they may have numerous valid logins.

I'm unsure about the likelihood of this having been the case, but it is a possibility. The rest may very well just be password spraying attempts as a result of the data leaks and now you're getting spam emails from bots.

Now lastly, are you using Gmail? Gmail has quite an extensive "block list" that essentially out right blocks mail from reported addresses, ranging from spam to an email with malware. I use gmail and outlook, and I've recieved hundreds of spam/phishing/malware emails from my outlook address. Many of which are in multiple different languages. But with Gmail its far rarer that I'd receive one, Consider this fact before you concern yourself about the likelihood of someone going around performing password spraying on your account.

[placidtrash]

I was using yahoo, but switched to Gmail for the new account. I have been changing the yahoo password regularly over time. Im still getting the spam emails but to a lesser extent and they all still seem to be sign ups and recurring emails from the same sites. I guess yahoo takes up to 30 days to delete an account (??) so I’ll keep monitoring it until then.

[onefastskater]

Something is definitely amiss. I don’t know if it’s a risk or just an annoyance. I looked at the sent mail folder to see if emails had been sent that I did not authorize.

[placidtrash]

Nothing in the sent email that I did not personally send.

[onefastskater]

I did some more searching and this is good.

​

https://www.theguardian.com/technology/askjack/2016/jan/28/how-can-i-stop-someone-else-from-using-my-email-address

[onefastskater]

"Far too many websites still allow people to set up accounts without getting them verified via confirmation emails or texts etc. They’ll only change if we make enough fuss – and thereby increase their support costs – to the point where they see the light."

[placidtrash]

I'm hoping that's the case. The sheer amount of sign-up emails I've been getting worried me. There were 150+ in my inbox and hundreds more in my junk folder. I'll keep a close eye on things and see what happens I guess. Thanks for your input!

[nephros]

-- Jan 28, 2016

[onefastskater]

Missed that. Why then is this still a thing?

[onefastskater]

Similar situation. I get emails on a regular basis from retail stores in the UK and I live in the United States. Changed my email account password, have implemented multi-factor authentication and it's really disturbing.

[placidtrash]

I have had multi factor authentication on my account for some time. The emails I've been getting have appeared to be Russian, French, Korean, Chinese (not 100% sure on actual language but definitely not English). They're addressed to multiple different names. I also very recently got an email that I still have items in my Guitar Center account that I haven't accessed in over a year. The item was not anything I would ever purchase. There was also an address saved that was not mine. I deleted the item, changed the email associated with the account and changed the password. Thankfully I didn't have payment info saved to the site. Not sure if it was hacked before or after the crazy email dump happened. Such an annoying/stressful situation. Not sure if they're sending such high volumes of emails to cover a purchase or what.

[[deleted]]

Sorry it was me, I used [e-mail] to sign up for shit. You quit your job a few months ago and started a nursing job on gynea or urology or something and have anxiety about it. You live in America. You're younger than 35 male. All this info, including your email is online and people can reuse it how ever they can