Before we can answer this question, it is important to know that
it is very easy to forge things like the To: and From: lines with
email. Just because the From: line says it came from you doesn't
mean you actually sent it, or that it came from someone using
your account. It may well just mean that someone forged the
From: line so it looked like it came from you. There
is more information about this in the
Forging Email FAQ entry.
Spammers and virus writers try all kinds of techniques to get you to read their
spam and open their virus attachments. In the case of a virus, you are probably
much more likely to accidentally open a virus-laden attachment if it looks like
it was sent by someone you know. For this reasons, many viruses go into
the address book of the infected machine and send the virus by email to all the
addresses listed and forge the From: line of the email to appear to be from
other people listed in the address book. If the email address of the intended
recipient is not valid, the message bounces back to the forged sender. So,
you may get such bounces returned to you even when you had nothing to do with
sending the email. Unfortunately, this is the result of the lack of authentication
in email and there isn't really anything you can do about it.
The same techiques are used by the spammers. They may have a list of
thousands of email addresses and may select addresses in the list to
throw in the From: line. One advantage for them of doing this is that
even an invalid recipient address may end up bouncing to a valid From:
address so someone still gets their junk. Furthermore, you may be more likely
to look at the spam content if it arrives looking like something
you sent. So, if you get an email that looks like a bounced return of
something you sent you may be curious and actually read the email
(which you probably wouldn't do if it was just a convential spam
message with the Subject of MAKE MONEY FAST).
We have also seen spammers
send email that just looks like a bounce. It wasn't ever
rejected by any mail server, but it is crafted so that you can't
easily tell.
As with most spam and viruses, it is often very difficult to track these back
to the original senders and equally difficult to figure out
who to complain to. You are probably better off just deleting
them and/or using
anti-spam tools
to try and filter them out.
