More than 1,000 unwanted registration emails - possible email address abuse

Question

Hello,

My Microsoft/Outlook email address appears to have been abused by someone else. Over the last few days I have received more than 1,000 account registration and verification emails from different websites that I never signed up for.

I have already changed my password, enabled two-factor authentication, reviewed my recent sign-in activity and signed out of all devices. I believe someone intentionally used my email address to register on many websites, possibly as part of a spam or malicious campaign.

Could you please investigate whether my Microsoft account has been compromised and advise if there are any additional measures I should take?

Thank you.

Answer 1

Nuno,

This does not necessarily mean your Microsoft account has been compromised. Therefore, changing your password or enabling two-factor authentication will not stop these emails.

For example, anyone who knows your email address can visit different websites and use it to subscribe to newsletters or create accounts. Those websites will then send registration or verification emails to you, but the person still cannot access your Microsoft account. Because the emails are being generated by many unrelated third-party websites, Microsoft has no way to prevent someone from entering your address on those sites.

This happened to me before with my Gmail address, so it can happen with any email provider. I shared my experience here:

https://learn.microsoft.com/en-us/answers/questions/5816973/junk-emails

This type of activity is commonly called an email bombing or subscription bombing attack. The large volume of messages may be intended to create noise and hide an important email. In my case, it was done to prevent me from noticing an alert from my credit card company about a large unauthorized purchase.

I strongly recommend carefully reviewing the emails for any genuine security alerts, purchase confirmations, password changes, banking notifications, or account activity that you do not recognize. You may also want to check your credit card and bank accounts directly.

Unfortunately, there is no quick way to stop all the messages. For legitimate newsletters, you can unsubscribe or mark them as junk. Be cautious about clicking links in suspicious registration or verification emails, as some may be phishing messages. It took several days before the volume decreased in my case. Even years later, I still occasionally receive random newsletter sign-ups, but the volume is no longer overwhelming.