E-Mail may have been compromised, trying to figure out how

I am wondering if this happened to anyone else, or they know someone who it happened to. I am trying to figure out if I have been hacked or not, and if so to what extent.

About a month ago my cousin's G-Mail account started sending mass-spam to everyone on his contact list, so he changed his password. It happened twice again though until he added two-step verification. Thing is, he hasen't used his pc in months if not years, he pretty much does everything from his phone and tablet, so it was very unlikely to have been a hack on his PC. I know smartphones aren't immune to viruses, but its not rooted and he hasen't installed anything outside of the Android Market and Amazon Market. His tablet is WebOS so theres practically no chance that one was hacked. And no, hes not stupid enough to fall for phishing or fake e-mail links.

Anyway, this morning this happened to me. Strangely though, none of my g-mail accounts were comprimised, my AOL account (which happens to be my main account) was... This makes even less sense. The e-mails all contained no subject and all the body had was a link to a web domain. However, they were all different domains, which resolved to different IP addresses in different countries and registered in differnet YEARS....... but they all ended with the same HTML page: "mronimer1.html". Googling the domains and html page gave me nothing. (e.g. (no, these are NOT real) www.site1.com.tr/mronimer1.html www.site2.eu/mronimer1.html, www.site3.tr/mronimer1.html, etc). Unless this guy has been registering random domains all over the world for the last 5-10 years and sprung his trap now, or hacked all of these sites and planted this mronimer1.html on all of them, this is just plain confusing to me.

I would chalk this off as my e-mail address being spoofed rather than hacked............. except that these were all sent to people on my contact list (mostly auto-reply bots from various web forums and onlinr stores). So... I guess thats not so much my contact list as its people who have sent me an e-mail at one point.... but anyway. They woulden't have access to this information if it was just a spoof right?

Any ideas how I can track down how I was hacked? Any way I can see how much of my system and passwords were compromised? The problem is although I changed it, I don't REMEMBER my AOL password, and although I have dozens of passwords, I very likely used it on many other sites if they got a hold of it. (Hey, I am literally subscribed to hundreds of websites, forums, etc for the last 15 or so years, I can't possibly come up with a new password for each one and REMEMBER it, many of these were before firefox and keychain-type apps).

I would say they got to the email server. And had such poor passwords they were easily figured out.

Have him check out his passwords.
http://www.passwordmeter.com/
2nd place.
https://www.microsoft.com/security/p...d-checker.aspx

Sorry that its been a while since I replied.

It was my account that was compromised this time, not my cousin's. It almost looks like my address was spoofed, except for the fact that they were sent to addresses on my contact list.

Whats weird though is that all those e-mails that were supposedly sent, none of them appeared in my outbox/sent folder. Is that normal? If they were sent from my account, would they have to appear there, or can they be hidden?

Yes, they can set it up where nothing goes to the sent box.

Think of it like regular old postal mail.

Anyone can send an envelope to anyone they like, and use your name and address as the return address.

The envelope may now look like it came from you ... but it didn't.

I'm aware of spoofing, the problem is that they were sent to everyone who had ever sent me an e-mail before, you can't get someone's address book or mail history through just spoofing their address.

Someone else has those same email addresses (plus many more) and they are sending out email to them all after sticking your email address in the From: field.