I got a call from some of my friends yesterday telling me they've been hit with multiple spam e-mails from my old MSN account. They forwarded one of the emails to me, and it was one of those standard "I am in [foreign country], was mugged, & please send me money" type of emails. Luckily, this is one of those accounts that I almost never use anymore, so the damage isn't too large. But I still can't seem to figure out how spammers got ahold of my login information. My password isn't too long or complicated, but it should be long enough to ward off simple brute-force attacks. It's an MSN account. I haven't actually checked my email on this account for well over a month. I have logged on to MSN messenger recently. I think here's where it went wrong. Could there be a keylogger somewhere on my system? I've used MSN messenger via Adium on my Mac. I'm using Adium 1.4.3 on OS X 10.6.8. I'm usually very careful with my computer, and I never visit anything suspicious. And the only software I've installed in the past month is Plex (downloaded from their official website) and a VPN connector from my university. I have Little Snitch and have not noticed any suspicious outgoing connections. I also logged into my MSN account on my iPad (with IM+ pro). It's iOS 5.0.1 and NOT jailbreaked. So I think the possibility of a keylogger getting on there is even more remote. There is also a second possibility. The thing is, I am traveling abroad right now (though I'm not in Spain, as the email claims). I've been using the hotel wifi for the first few days before they fixed the ethernet jack in my room. The hotel Wifi is not secured at all. It is possible that somebody did a Man-in-the-middle attack or something. I'm also suspicious of the hotel staff. Is it possible that their IT staff were snooping around my traffic and somehow got ahold of my login info. In any case, I'm using my school's VPN for all connections. That should help right? But what if it's a keylogger on my system? Is my iPad + VPN the safest system I have right now? I'm afraid that my other accounts are compromised as well. But I'm afraid to logon to the other accounts lest I compromise more passwords. What should I do?