email spoofing

Spam that appears to come from your own address is almost always a forged sender — check three places to know if you were hacked

Most spam that arrives 'from' your own address is a forged sender field; your account was never touched. Japan's IPA and JC3 have both warned about extortion emails dressed up this way, and IPA says its help desk has not seen a single case of footage actually being released. This site's view: the sender field is self-declared. Before you panic, spend five minutes on three places — Sent, sign-in history, forwarding rules. And if the email quotes a password you still use, change it today.