It would appear that over the last two or three days several people have been receiving spam e-mails from an account that I used to own but no longer use. I feel that I owe it to the public to explain this situation.

Most people happily use their email accounts and never question how they work. And although I won't give a long exposition on the SMT protocol or POP services, I can give a simple explanation. When you send an email message, the application that you are using adds header information that tells the network who is sending the message, where it is going, and a lot of other details. When the receiver receives the message, their email application hides all of this data and the user rarely ever sees it.

Unfortunately it is quite simple for even an inexperienced programmer/hacker to change the headers on their outgoing mail. Without having any access to someone's real email account, a hacker can put anyone's email account into the "From" section of an email address. It is in fact so simple that even a beginner programmer could do this in under a minute, and there are websites that automate the process for non-programmers. And if the receiver isn't cautious, they will see an email message sent from a real account and not know anything is wrong with it.

And worse yet, if the hacker is sending spam then recipients or their ISPs get angry at the legitimate holder of the sender account and often do not realize that that person had nothing to do with the email messages being sent out. 

This is called Joe Jobbing, named for an infamous attack on the website joes.com by a user banned for abusing their services, and is often used to discredit or punish an innocent victim. And unfortunately there is very little that can be done about it.

That is what has happened to me, although fortunately it was an attack on an address that I have not used in almost a year. And I have the added difficulty that the account was part of a website that I setup and maintained for some friends, and so my name remained on the WHOIS data as well. (The website was taken down long ago, but the email servers remain in use as some people still get messages through them.)

So all I can do is apologize to the people affected, and repeat that I have not used that address in a long time, and the messages being sent out are not legitimate.