Spam received from my own email address

You may receive a spam message whose visible sender is your own address. That field can be forged and doesn't prove on its own that someone has got into your mailbox.

It is often a forgery of the visible sender, but the symptom alone doesn't rule out authenticated sending or a compromised application. Also, a forged message may contain phishing or malware and shouldn't be considered harmless.

1. Look in Track Delivery to check whether the account sent anything at that time.
2. Review the full headers and the SPF, DKIM and DMARC results, along with Received and Return-Path.
3. If there is no outgoing event and the headers show third-party infrastructure without alignment, treat it as spoofing.
4. If authentication or activity you don't recognise appears, change the password and follow the compromised account procedure.

Keep SPF and DKIM correct. After you have inventoried and aligned every legitimate sender, a DMARC quarantine or reject policy can reduce acceptance of exact spoofing by receivers that apply it; p=none only lets you observe the results. To classify messages that still reach the mailbox, turn on the anti-spam service.

What to do with the message

Don't reply, pay or open attachments just because the sender matches your account. If it contains an old password, change that password on any service where you still use it; its presence doesn't prove current access to the mailbox either.

Check that the tracking covers the message's date before reading anything into the absence of a send. If there is outgoing activity you don't recognise, follow the guide to containing unauthorised authenticated email. DMARC helps against forgery of the exact domain, but it doesn't stop someone using a similar display name or a lookalike domain.