My contacts have recently been receiving spam emails from my Gmail address. I am quite certain it is my Gmail contacts (one address is a craigslist response address that I once used). So it would appear my contact list has been accessed in some way.
But I am also fairly certain that the emails are not originating from my Gmail account. I've written an SMTP client, so I know how easy it is to spoof the "from" address, and my Spam folder has several bounces of emails that were "from" me, but were not sent using a Gmail server.
There have been no recent unusual accesses to my account, according to the lists Google provides.
I recently changed my password to something I believe to be quite secure (in response to the heartbleed thing), I don't use any mail clients to access my Gmail accounts.
All this adds up to a few possibilities:
- My account was compromised before I changed my password, but no one bothered to use it until now.
- My account is currently compromised, but the spammer is using a different account to send emails, while still bothering to spoof me (seems unlikely?).
- A computer on which I was logged into my Gmail account was compromised, and an automated attacker obtained my contacts list from that, somehow.
So I'm wondering how likely possibility 3 is. If such a thing is possible, that would seem to be the most likely method used, based on the above evidence. But I am open to other explanations as well.
edited to add: i should mention, also, that none of my settings have been changed, and that nothing shows up in my sent folder (though i know that's not necessarily informative).