Where is my email address being used?

• Where you put it. Services you joined. Our guide on how to find accounts linked to your email rebuilds that list.
• Where it was traded. The ACMA says a business that buys a marketing list is still responsible for making sure it has consent for every address it uses. The list changes hands; the obligation does not.
• Where it leaked. The OAIC received 1,205 breach notifications in 2025, up 8% on 1,112 in 2024. Most named no company publicly, which makes a breach the hardest cause to confirm and the first one everybody assumes.
• Where someone else typed it. Google says it cannot prevent people from accidentally or maliciously using a dotted version of your address to sign up for subscription emails.
• Where it was forged. Bounce-backs for mail you never sent are backscatter: your address in a fake sender line, not a hacked mailbox.

In Gmail, search subject:(welcome OR "confirm your subscription" OR "reset your password" OR "verification code") OR from:mailer-daemon and read the results newest first. Gmail's own bounce-backs come from mailer-daemon; in Outlook, search for "undeliverable" too. Other providers accept the same words as a plain search. Clusters matter more than single messages: fifteen unrelated confirmations inside ten minutes is one event, not fifteen.

Under the Spam Act 2003 and the Spam Regulations, a commercial message needs consent and accurate sender contact details. Its unsubscribe must be honoured within 5 working days, be free, keep working for 30 days, and need no login or extra personal information. If a message fails any of these, it is reportable, not just annoying. The exception is the exempt senders listed further down, such as registered charities and government bodies: they must give sender details, but they need neither consent nor an unsubscribe.

An unrequested password reset is the one genuinely new fact in your inbox: it proves an account exists at that service under your address. An unrequested sign-in code means someone tried to get in. Many services send a code instead of asking for a password, so that alone is an attempt. A second-step code that arrives after a password is worse: the password already worked. Bounce-backs are the opposite: if your Sent folder is clean and there are no unfamiliar sign-ins, someone is forging your address. Only the owner of the sending domain can stop that, with the SPF, DKIM and DMARC records ASD's ACSC documents.

The point is not anonymity, it is attribution. A unique address per service tells you who sold or leaked it, which no check above can.

Nothing lists every marketing list that holds your address. Australian list brokers do not have to publish their buyers, and businesses with an annual turnover of A$3 million or less are generally outside the Privacy Act 1988 under the small business exemption. A small operator can sell or lose your address and never tell anyone. No single email shows whether you were bought or inferred: ask the sender, which the Australian Privacy Principles let you do with a covered business. Only volume separates a typo from a deliberate signup.

Some senders never needed consent. The ACMA exempts registered charities, education institutions contacting current or former students, government bodies and registered political parties, though all must still give contact details.

The penalties are real. On 15 April 2026 the ACMA announced that Latitude Finance Australia paid $3.96 million for more than 2.7 million breaches of the spam laws, including 344,416 messages with no working unsubscribe. It was Latitude's second spam penalty, after $1.55 million in 2022.

Subscription bombing is measured, not anecdotal. Mathias Payer and Candid Wüest analysed 24 campaigns totalling 46,970 emails for the ACM in January 2026: 1,957 messages per attack on average, the largest wave 4,847 in under two hours, and over 71% not caught as spam by Microsoft 365. A flood like this can be cover for a security alert or a purchase confirmation, so look for what it is burying.

If a breach does turn out to be the cause, see what to do if your email is in a data breach.