My email is sending spam: hacked or spoofed?
2 min read · Updated October 15, 2026
If the spam is in your Sent folder, your account was probably hacked: change the password, sign out all sessions and remove rogue rules. If your Sent folder is clean, your address was most likely spoofed, which you cannot stop directly, but you can tell contacts and secure your account.
Step 1: check your Sent folder
Look at Sent, Drafts, Trash and Archive. Messages you did not write mean someone used your account. A clean Sent folder points to spoofing, where the attacker forged your address on messages sent from their own systems.
If your account was hacked
- ✓Change your password and sign out of all other sessions.
- ✓Remove unknown forwarding rules, filters and connected apps.
- ✓Enable two-factor authentication.
- ✓Tell contacts not to click anything from you during that period.
First, see what was actually exposed
Before you change anything, find out whether your address shows up in known breach records. The free check takes seconds.
If your address was spoofed
Spoofing does not require access to your account, so changing your password will not stop it. You can still secure your account, run a breach check and let contacts know. If you own the domain, SPF, DKIM and DMARC records make spoofing much harder.
Why your address was picked
Spammers use addresses found in breaches or harvested from contact lists. Seeing your address on spam is another reason to check whether it was exposed.
Frequently asked questions
Can I stop spoofing?+
As an individual you cannot fully stop it. Domain owners can reduce it with SPF, DKIM and DMARC.
Does this mean my contacts were leaked?+
Possibly, if your account was hacked. Spoofing often uses addresses from older leaks or guessed combinations.
Will my address get blacklisted?+
Heavy spam can hurt deliverability. Securing the account quickly limits the damage.
Stop guessing. Check your email in seconds.
The free Leakill check looks for your email address in known breach records and tells you whether it was exposed. If it was, an optional detailed report lists the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-off report, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.