I am wondering if this happened to anyone else, or they know someone who it happened to. I am trying to figure out if I have been hacked or not, and if so to what extent.

About a month ago my cousin's G-Mail account started sending mass-spam to everyone on his contact list, so he changed his password. It happened twice again though until he added two-step verification. Thing is, he hasen't used his pc in months if not years, he pretty much does everything from his phone and tablet, so it was very unlikely to have been a hack on his PC. I know smartphones aren't immune to viruses, but its not rooted and he hasen't installed anything outside of the Android Market and Amazon Market. His tablet is WebOS so theres practically no chance that one was hacked. And no, hes not stupid enough to fall for phishing or fake e-mail links.

Anyway, this morning this happened to me. Strangely though, none of my g-mail accounts were comprimised, my AOL account (which happens to be my main account) was... This makes even less sense. The e-mails all contained no subject and all the body had was a link to a web domain. However, they were all different domains, which resolved to different IP addresses in different countries and registered in differnet YEARS....... but they all ended with the same HTML page: "mronimer1.html". Googling the domains and html page gave me nothing. (e.g. (no, these are NOT real) www.site1.com.tr/mronimer1.html www.site2.eu/mronimer1.html, www.site3.tr/mronimer1.html, etc). Unless this guy has been registering random domains all over the world for the last 5-10 years and sprung his trap now, or hacked all of these sites and planted this mronimer1.html on all of them, this is just plain confusing to me.

I would chalk this off as my e-mail address being spoofed rather than hacked............. except that these were all sent to people on my contact list (mostly auto-reply bots from various web forums and onlinr stores). So... I guess thats not so much my contact list as its people who have sent me an e-mail at one point.... but anyway. They woulden't have access to this information if it was just a spoof right?

Any ideas how I can track down how I was hacked? Any way I can see how much of my system and passwords were compromised? The problem is although I changed it, I don't REMEMBER my AOL password, and although I have dozens of passwords, I very likely used it on many other sites if they got a hold of it. (Hey, I am literally subscribed to hundreds of websites, forums, etc for the last 15 or so years, I can't possibly come up with a new password for each one and REMEMBER it, many of these were before firefox and keychain-type apps).