Mail has been tampered with and I don't know where to look

Question

I have a client who is going through a divorce and her soon to be ex-husband has tampered with her email on her Apple computer. She is running 10.5.2 and using the standard mail client. She noticed when she opens an email the email is forwarded automatically. No rules have been setup. There are no traces of the mail in the outbox or the sent messages folder yet she recieved some bounce messages saying emails weren't accepted due to virus/spam blocks. Where can I look to stop this forwarding action or what software would do this ? What logs can I look at ?

Answer 1

I see two possibilities here:
1. The situation is incidental. Do the messages she's getting the supposed bounce notifications for match ones she's actually received? The reason I put this first is that it wouldn't make sense to forward email to an address that's going to bounce, if the point is to spy on the emails. That would bring such activity to someone's attention immediately. If it doesn't seem to be happening to all messages, its likely this is actually the result of a spamming or phishing operation of some sort. Spammer spoof known valid email addresses, and thus you get bounces for messages you've never sent. A phishing tactic to harvest email accounts to use for spam has you get a supposed bounce notification, then you are offered a link to log in. The link of course does not lead to the actual mail site, and you provide your credentials to access the account which are then stolen.
2. If the mail is being forwarded, it has been set up at the provider end, and not at the local computer. Most webmail providers now offer forwarding service, especially Gmail. If one were to have access to the account credentials, or even just one time were able to access the account from the person's computer, they could set up the forwarding with the email provider. Nothing would be required on the target's computer, and nothing there would be changed.