...Guess too much praise can get to your head (looking at you Live mail).
I was minding my own business when all of a sudden I got a new mail message alert on my Ipad. Boy was I surprised when the sender was none other than... Me.
Initially I thought it was my ancient Yahoo! account (which I still use to reduce exposure to my Live mail address) but, to my dissappointment, it wasn't that one (there were recipients in the header that weren't on my Yahoo! contacts list).

First things first, I changed my password and enabled HTTPS in my account options (kept it off until now because the site warned me that I wouldn't be able to sync PocketOutlook with it otherwise).
Looking through the header of the spam, the X-Originating-IP field was off : the IP belongs to a French ISP. Everything else seemed normal.

One thing I noticed though, the link contained in the mail pointed to a Polish server : perhaps the computer that used my mail was actually a zombie ?

At any rate, I intend on getting to the bottom of this : I won't sit idly by while someone uses my name and address to spam my own contacts.
I could contact the French ISP, but will that achieve something ? Maybe its just some unsuspecting Jon Doe that had his XP machine compromised because he couldn't be bothered to RTFM before plugging that internet cable in his PC.

I'm also thinking about making my own mail server, just for me. At least then I'd have full control over it and anyway, it was a long time coming since I wanted to build a server.

Nobody has access to your account, you can be 99% sure of it. It's very VERY easy to spoof the "From" field when sending e-mails. I get them all the time, always from obvious spammers. The best thing you can do is ignore it or set up a rule to reject all e-mails sent from your own address. But remember if you do this you won't get any mail you do send to yourself (something I do as reminders on occasion).

Running your own mail server won't change anything, and you have to know how to run one and set up the spam controls effectively if you do decide to run one.

I'm not extremely bothered by the fact that I'm receiving spam (actually I don't receive much at all and the filters I've set up trimmed the bulk of them anyway). what actually annoys me is that someone is using my ID to spam the people in my contacts list.
And anyway, supposedly the spammer found my e-mail address somewhere and forged a fake "From" field. If that's the case, then how did he get access to my contacts list because those are the only people targeted ?

The mail I received contained exclusively people from my address book. The same kind of mail that arrived on my father's laptop contained a different batch of people all of them being my contacts.
As far as I know, no outsider can figure out my list of contacts unless he either : gained access to my account or tracked most of my correspondence throughout this year.

As for setting up a mail server, I enjoy a challenge, especially when you can learn something new I once set up a TS Web Access server but that was some years ago.

In that case, you have probably been compromised by malware. The issue I describe only affects messages sent to you, not your contacts. I suggest you run a full sweep with anti malware programs (Spybot Search and Destroy, Malware Bytes, etc).

Thanks for the advice ! Initially I thought it couldn't be something on my side because I don't store any mail or run any e-mail clients locally, but that just goes to show how naive I was. I mean, they could easily monitor my browser and internet traffic.

Odd though, I did run a thorough scan with MSE some weeks ago and except for the usual false-positives (no-cd fixes, anti-Origin stuff, activator for my laptop so that I won't have to call MS every month because I decide to try some other OS), everything was fine.
Heh, the last time any of my computers got infected was when I was running WinME.

Ugh, I feel like a real noob when it comes to network security. Apparently, there are times when common sense isn't enough to keep you safe.

I ran both the Malicious Software Removal Tool and MSE on the entire system. Nothing was found. No malware, no viruses, nothing.

Probably whoever got access to my contacts did so through the Live mail servers. Admitedly, a dictionary attack would've been enough to break into my account. Anyway, if that was the case, whoever did this will have a harder time cracking my new password.

Ain't it a small world... Just got a message from Sony saying that "my" PSN account was successfully registered. Lucky me I guess, except that I never registered nor own any Sony device.

Coincidence ? Perhaps, but still, I never made that e-mail address public Anywhere on the internet, plus, I use it only for important maters.


EDIT : to clarify, it wasn't spam (like the tons of Blizzard mail I get on my other, Yahoo! account), it was as real as it can get.

Then look whose account it is, and write to Sony!

Already did that. They said the account will be removed in 48h . I'm glad I don't have any credit cards associated with my Live account. Microsoft better beef up security on their service if they want people to log in to Windows with it.