Title:  Who sent this email using my computer or UWNetID?

Question:
I received a copy of an e-mail that looks as though I sent it. I didn't
send this message, so does that mean someone has access to my account?

Answer:
It could mean that someone has accessed your account but most often it
does not.  There are many ways to make an e-mail message *look*
like it came from a specific account or computer - sometimes it's done
on purpose, other times it's done without the knowledge of the person
sending the message.  Following are some example scenarios in which a
message can be sent using what looks in the "From:" line to be another
person's identity.

	o Someone used an e-mail application on a computer that is
	  pre-configured for another person (you).

	o There are an increasing number of computer viruses designed 
	  with the sole purpose of sending large amounts of email from an
	  infected computer.  It's possible that someone has your email 
	  address in their address book and is infected with such a 
	  computer virus.  Likewise, it's possible that your computer is 
	  infected with such a virus.  The only way to be sure you're
	  safe is to have antivirus software installed, configured, and 
	  running on every computer you use to check your email.

	o Someone tried to "forge" an email so it looks like it came from
	  another person.

If it does seem likely that someone has access to your account, change
the password on all your accounts immediately and contact us for
further assistance.  Given the proper information, we can examine an
e-mail message and determine if it really was sent using your computer
or email account.

The first thing you need to do when it appears that someone has sent an
e-mail message from your account is to obtain the entirety of the original
message in question.  Without this it is all but impossible to determine
the true source of the message.  Once you have a copy of the message,
it's vital that the full delivery headers for the message be displayed.

If you do not have a copy of the original email which appears to have been
sent from your account, there is little to nothing that we can do.  If you
do have a copy of the message, then we can look at its full delivery headers
and work from there.

If you're unable to interpret the full headers for this message properly
yourself, please forward it (with the full headers displayed) to
security@cac.washington.edu so that we can examine the message for you.
In most cases it is possible for us to determine the computer used to
send the message, the date, and the time.  This information, combined
with other information we may gather, ought to help us better understand
how the e-mail message in question was sent the way it was.