Spam again? Use email aliases to trace subscriptions, forwarding and possible leaks

Start with the facts: spam is a clue, not proof of a data leak

You give a website a unique email address. A few weeks later, an unfamiliar promotion arrives at that address. That tells you it was used for a message you didn’t expect, but it doesn’t prove the website sold your data. Subscription settings, partners, address reuse, public exposure or even random guessing could all explain it.

There’s usually no one-click answer to “How can I find out which website leaked my email?” The value of a unique email alias is that it narrows down which points of contact to check and lets you turn one off on its own. It doesn’t automatically identify who’s responsible.

First ask, “Which address was this message actually sent to?” Then ask, “Who have I given that address to?” Even if you can answer both, you may still need more evidence or an explanation from the sender.

Four possibilities to consider when tracing an email in 2026

If you’re wondering why you’re suddenly getting lots of spam, start with these possibilities instead of looking for just one suspicious website.

More than one explanation may apply. A genuine subscription could be sent through an external email service, while an unfamiliar sender might be impersonating a business you know. Keeping several possibilities open is usually more reliable than jumping to one conclusion.

Before signing up, create a record you can revisit

The most useful record is often made before the first promotional email arrives. Use a unique address for each website and note the website domain, address, sign-up date, purpose and the marketing choices you actually made. Record “the box wasn’t checked by default” separately from “I actively unchecked it.”

• Be specific about the purpose: claiming a discount, downloading a resource, or receiving order and refund updates.
• Note where you can verify your choices, such as the notification settings in your account.
• If you take a screenshot, keep only the relevant area and hide your name, order details and verification codes.
• If you later give the same address to another service, add that to the record too.

You can use the source tracking sheet to keep track of what you find. It’s a local record-keeping tool: it doesn’t scan websites, create email addresses or gather evidence for you. Records stored in the page may be lost when you close or refresh it, so export them when needed.

When an unexpected email arrives, note four things

Don’t click buttons in the message yet. Note the recipient address shown, subject, when you first noticed it and any related actions you took beforehand. Distinguish “I first saw it today” from “it arrived today” so an old backlog doesn’t look like a sudden surge.

Check the recipient address in the message details rather than relying only on which main inbox is open. If the message was BCC’d, the To field may not show your address. In that case, record “original recipient address not shown in the interface” instead of guessing.

Include the time zone when recording the time. You can also note the frequency and any changes to the sender domain, but don’t reply to an unfamiliar email, click unsubscribe or submit personal details just to investigate its source. The record should reduce risk, not create another point of contact.

Display name, From and Reply-To are not the same thing

The display name is just a name the sender chose

A business name in your inbox doesn’t mean the message came from that business. Expand the full sender address and check the domain character by character. Lookalike spellings, extra subdomains and familiar logos can all be misleading.

From identifies the sender; Reply-To sets where replies go

A mismatch may be normal for a support team or marketing platform, or it may be worth investigating. The difference alone proves neither fraud nor trustworthiness. Don’t email the Reply-To address to “test” it. Check using the business’s known official app or by entering its website address yourself.

Email authentication can also support only limited conclusions. It may help verify a sending domain or signature, but it can’t prove you agreed to receive marketing or show how the sender got your address. If these terms are unfamiliar, start with the spam email glossary.

Email headers and forwarding paths can help, but only as supporting clues

If your email app offers “View original,” you can check fields such as To, Received and, where present, Delivered-To or X-Original-To. The latter fields don’t appear in every message, and their meaning and reliability depend on the email system.

Each server hop usually adds a Received entry, which can help you understand the delivery path. Earlier entries may contain untrusted content, though, so don’t treat any single line as proof of origin. Forwarding, rewritten return addresses and differences between email apps can also make the path harder to interpret.

In particular, don’t mistake the destination inbox for the original source. Your main inbox may contain a forwarded copy, and some fields may show the forwarding service or final delivery address. Compare them with your alias records rather than assuming a business had your main inbox address. Before sharing email headers, hide personal addresses, network details and unique identifiers.

Keep facts, memories and assumptions separate in your tracking sheet

Records are most likely to become inaccurate when “I can’t remember” turns into “It never happened.” Label each entry so you can revise it when new information comes to light.

Confirmed facts

The message details show delivery to a particular alias; marketing is currently turned off in your account settings; you received a promotion on a certain date. Note when you observed each fact and what it’s based on.

Personal recollection

“I remember leaving the marketing box unchecked when I signed up.” Keep the original wording and note that you have no screenshot or confirmation from the time.

Unverified assumption

“It may have come from a joint promotion.” Note what you’ll check next, such as reviewing the campaign terms, rather than writing “The website sold my address.”

Don’t store login tokens, temporary email access credentials or valid verification codes in your tracking sheet. You need clues about what happened, not keys that open an account.

Reusing an alias makes it harder to pinpoint the source

If you use one “shopping” address with five stores, it still separates those messages from your main inbox, but it can’t link a new promotion to just one store. Forwarding the address to a friend, posting it in a public document or using it for another campaign adds more possible sources.

In that case, fill in the past uses and note “Address used with multiple sources; source can’t be uniquely identified.” For new sign-ups, use a different address for each site. You don’t need to move every account right away just to create a perfect record. Avoid putting your name or phone number in the address prefix. A random prefix may make it harder to guess, but it doesn’t guarantee privacy.

Use official channels for subscriptions you recognise; don’t test links in unfamiliar emails

For a business you recognise and can verify independently, turn off marketing through its official account settings. If you confirm the subscription is genuine, you can also use the unsubscribe feature in a trusted email app. Allow time for the business to process your request, as its instructions specify.

For an email from an unknown source, don’t click its unsubscribe link, visit other links or reply just to check whether your address is active. Use your email provider’s report-spam and filtering tools. If you suspect phishing, check your account through an official channel rather than signing in via the email.

Unsubscribe or change your email address? The right choice depends on what you’re dealing with: unsubscribe from marketing you can verify, filter messages through your inbox rules, or disable the alias to stop all future mail to that address.

Before disabling an alias, check who still relies on it

Disabling an alias can quickly stop mail at one point of contact, but it also stops order updates, refund notices and account recovery messages. Check for open orders, support cases, sign-in verification and security alerts before deciding.

• Open order: keep essential updates coming and turn off marketing separately.
• Account recovery: change the address in the official settings to one you can keep using long term, then complete verification.
• No need to keep receiving mail: note when you disable it, then turn off the alias in your dashboard.

Mail sent while an alias is disabled is discarded and can’t be recovered by re-enabling it. For tasks that only need a short-term verification code, you can use a disposable email For ongoing notifications, use an address that can keep receiving mail; don’t decide based only on how much marketing you get.

Three records, each with a different purpose

Hushinbox’s 30-day forwarding archive is for checking recent messages, not keeping permanent evidence. Copies forwarded to your main inbox are managed by your email provider. Your local tracking sheet stores the uses, observations and conclusions you enter yourself. These three records aren’t automatically deleted together.

Deleting the archive on this site won’t remove copies that have already been forwarded. Disabling an alias won’t remove past messages from your main inbox. Temporary email has different limits: new addresses last 3 hours by default, and each successful extension adds another 3 hours. They’re cleared when they expire, so they’re not suitable for long-term tracking.

If you need to keep records, save only the necessary information in a redacted form, and set your own cleanup schedule. See the Privacy Policy for details about data handling. If you’re still deciding how long to keep an address after claiming a discount, read How long to keep an address for verification codes, orders and refund updates.

A full review: reduce unwanted mail without blaming a source

Suppose you used a unique alias for a promotional shop and later received an unfamiliar offer. You record the recipient address, subject and time, and confirm you haven’t knowingly given the address to other websites. But your memory of the marketing choices you made at the time is unclear.

Next, you check the shop’s official website for notification settings and campaign terms. They mention partner marketing, but you can’t confirm whether the unfamiliar sender is a partner. You write, “Unexpected marketing sent to a unique address; source unverified,” rather than “The shop sold my data.”

Finally, you confirm the order is complete and the recovery email has been changed, then disable the alias and note when you did it. Even without knowing how the address first reached the sender, you’ve stopped further messages at that point of contact. If a reliable notice appears later, update your assessment. That’s what a tracking sheet is for.

Frequently asked questions

Why am I still getting marketing emails after changing my address?

First check the actual recipient address and when the new message arrived. It could be an old copy, another alias that’s still active, or an email change that hasn’t been completed in your website account. Changing a temporary address won’t update your accounts on other sites or stop subscriptions to your main inbox.

Why are old emails still there after I disable an alias?

Disabling an alias stops future forwarding; it doesn’t delete past messages. Manage copies in your main inbox and the site’s archive separately. Also check when a message was sent and forwarded before concluding that disabling the alias didn’t work.

Can I find out exactly who sold my address?

No. Unique addresses and email headers can provide clues, but they can’t automatically prove that someone sold your data. If there’s a dispute affecting your rights, keep necessary records and ask about the data source through the business’s official channels. Don’t publish unverified accusations or other people’s personal information.