topic Re: Bad emails in Tech Help - Software/Hardware etc

Bad emails

penneck — Sun, 05 Apr 2026 13:37:03 GMT

A few weeks ago I received an email from a friend. It looked a bit odd, so I replied asking for clarification. It turned oiut her email account had been hacked and my reply sucked me into the problem. Since then I've been getting emails making faise claims against me. I use Mailwasher so could see those emails before they got to my pc, and deleted them there. Eventually I blacklisted that address. Now I'm getting them apparently coming from my own email address, and quoting my Plusnet password.

I've used Malwarebytes Free, Spybot, and Microsoft Security Essentials but nothing spotted except Spybot stated Error During Check - Win32.OnLineGames.gen, but it didn't do anthing about it.

Any suggestions as to how I deal with this?

Many thanks for any help. I've unticked the box so your replies dont get emailed to me in case he/she can see them

Re: Bad emails

Baldrick1 — Sun, 05 Apr 2026 14:22:47 GMT

@penneck

Change your Plusnet password and, heaven forbid, any other accounts if you have ever reused passwords.

Not many can be bothered but if I find any of my email addresses listed as leaked on the haveibeenpwned website, I scrap that address.

Re: Bad emails

penneck — Sun, 05 Apr 2026 15:21:55 GMT

Thanks @Baldrick1 . I have just gone onto Plusnet to do as you suggest, and it seems I changed my password a long time ago, so it must have been years since I used the password that person was quoting - it was so long ago I had forgotten I had done it. Therefore I'm not using that password any more anyway.

So the questions are:-

How is he/she sending me emails which shows my email address as the source?

How can I stop that happening?

Could he be deliberately quoting a wrong password to stop me changing my password?

Can he see my email address book, so he can get other people to bother?

Regards and thanks

Re: Bad emails

PhilipHeyes — Sun, 05 Apr 2026 16:05:53 GMT

"How is he/she sending me emails which shows my email address as the source?"

Plusnet have configured SMTP server relay.plus.net as an Open Relay, making possible to send emails as you describe without being a Plusnet internet customer and without needing a Username or Password.

Re: Bad emails

penneck — Sun, 05 Apr 2026 17:37:52 GMT

Is there a way I can identify his emails, no matter what source email address so I can blacklist them, without adversely affecting my emails? That way, if he changes to yet another source address, his emails to me are automatically blacklisted

Cheers and thankyou

Re: Bad emails

Champnet — Sun, 05 Apr 2026 18:31:22 GMT

Be careful not to accidentaly block yourself ! Block on unique concurrent words in the subject field.

Not sure if Mailweeper has this facility, @jab1 may be able to help. If not use your client software..........

Re: Bad emails

jab1 — Sun, 05 Apr 2026 18:53:21 GMT

AFAIK, MW does not have that facility, and I unfortunately can't check - a recent OS update means I can't open that program - they forgot, or decided not to include the relevant folder in the revised coding. My version of MW is based on 32-bit architecture, and the i386 folder is no longer there.

Re: Bad emails

Champnet — Sun, 05 Apr 2026 19:04:38 GMT

Thanks @jab1 A quick install of Ver 7.15 shows under 'Spam Tools -> Filters' there is an option to set up rules including 'subject contains'

Re: Bad emails

jab1 — Sun, 05 Apr 2026 19:14:34 GMT

OK, @Champnet . Unfortunately, that version, or at least the fully-featured 'Professional' one I need for multiple mailboxes is subscription-only - and as I am moving away from Plusnet/Greenby I am loath to pay for something I am not likely to need in the next 2-3 months. MW themselves have said that 6.5.2 is the last one that will work on Linux systems.

Re: Bad emails

Champnet — Sun, 05 Apr 2026 19:49:35 GMT

A quick install of Ver 7.15.45_Pro_Free shows under 'Spam Tools -> Filters' there is an option to set up rules including 'subject contains'

Re: Bad emails

jab1 — Sun, 05 Apr 2026 19:56:55 GMT

Is this on Windows or Linux? As I said, Mailwasher support did say 6.5.2 was the last version compatible with Linux, and I haven't checked any later versions.

Re: Bad emails

mwwagain — Sun, 05 Apr 2026 20:02:31 GMT

Has your email been transferred to Greenby yet ?

If so most of the complaints are of Greenby putting legitimate emails into 'spam' and therefore not delivering - rather than spam getting through that should not.

Re: Bad emails

Champnet — Sun, 05 Apr 2026 20:04:37 GMT

Running in a Win 10 LTSE setup in a Virtual Machine on a Synology Server…

Reckon we’ve discussed my lack of interest in Linux or Unix before.

Re: Bad emails

jab1 — Sun, 05 Apr 2026 20:07:49 GMT

@Champnet wrote:

Reckon we’ve discussed my lack of interest in Linux or Unix before.

Fair enough - I have no interest in Windows, either.😀

Re: Bad emails

Champnet — Sun, 05 Apr 2026 20:20:28 GMT

Invalid reply

Re: Bad emails

7up — Tue, 07 Apr 2026 13:53:23 GMT

@PhilipHeyes wrote:

"How is he/she sending me emails which shows my email address as the source?"

Plusnet have configured SMTP server relay.plus.net as an Open Relay, making possible to send emails as you describe without being a Plusnet internet customer and without needing a Username or Password.

And how likely do you think that really is? - A major UK ISP getting itself and it's IP ranges blacklisted.

Wakey wakey..

Re: Bad emails

corringham — Tue, 07 Apr 2026 14:57:06 GMT

@PhilipHeyes wrote:

Plusnet have configured SMTP server relay.plus.net as an Open Relay, making possible to send emails as you describe without being a Plusnet internet customer and without needing a Username or Password.

I don't believe that is a good description of what is happening. To send an e-mail FROM a Plusnet address you need to be on the Plusnet network and/or be authenticated.

To send an e-mail TO a Plusnet address you need a server to accept your e-mail, and then any intermediate servers to pass it on to Plusnet's server to pass to the recipient. You shouldn't need to be authenticated to relay an e-mail, otherwise every sender would have to authenticate for every recipient domain - which is quite impractical. Some servers may enforce DKIM or SPF etc to avoid passing on e-mails that are pretending to be from a different domain to the one they were sent from, or may refuse to relay e-mails from sources that have a "bad" reputation.

However, when sending an e-mail you can use any FROM: string you like - it has no impact on the delivery of the e-mail. It is like writing "from <XYZ>" on a postal letter - it will be delivered using the TO: address.

When sending spam messages it is common to use the recipient's address as the FROM: address as it is unlikely to be blocked by that recipient's spam filter.

Re: Bad emails

mwwagain — Tue, 07 Apr 2026 16:34:25 GMT

@corringham wrote:

When sending spam messages it is common to use the recipient's address as the FROM: address as it is unlikely to be blocked by that recipient's spam filter.

Or that 'Spammy' uses a known pair of email addresses (a 'to' and a 'from' pair) that have been harvested from hacking an IMAP mailbox. Again to increasing the chances of being believed and avoid junk filters

An SMTP mailbox is of course usually empty.

Re: Bad emails

penneck — Thu, 09 Apr 2026 18:54:49 GMT

@corringham I thought I had heard some months and possibly years ago that there was a way of being able to see a senders genuine address if they had put a fake sender address on an email - and just out of curiosity, is that corringham near where the old but long gone shell haven oil refinery was?

Regards and thanks

Penneck

Re: Bad emails

mwwagain — Thu, 09 Apr 2026 22:29:24 GMT

I run spam through SpamCop as a reporting tool, it reports to the IP address and host of the 'last step' before the email reaches legitimate steps.

There is usually one earlier 'known faked' step from which mail should not have proceeded.

There is no requirement for there to be a 'real' sending address at all - just a mail server to send the junk content with the faked header