If your inbox went from a few junk messages a week to dozens a day, something specific changed: your address was sold, leaked, guessed, or confirmed as live. Spam is a numbers business, and senders only pour effort into an address once they believe a real person reads it. The good news is that each cause leaves its own fingerprint, and once you know which one applies, the fix is usually direct. Below are the nine causes we see most often, roughly in order of how likely they are, with what to do about each.
1. Your address was in a data breach
This is the most common trigger for a sudden spike. When a company you signed up with years ago is breached, the stolen customer list is traded between spammers for months afterwards. The tell is timing: the junk starts within days of a breach announcement, and much of it targets the kind of product the breached company sold. Check your address on a breach lookup service such as Have I Been Pwned. If it appears in a recent dump, the flood is explained.
Fix: You cannot pull the address back out of the list. What you can do is change the password on the breached account and anywhere you reused it, then turn on two-factor authentication there. Our guide on what to do after a data breach walks through the full checklist. From here on, the spam itself is a filtering problem, covered in the fixes further down.
2. You replied, clicked, or unsubscribed from a spam message
Bulk senders start with huge lists of addresses, many of them dead. Any reaction from you proves yours is alive and watched. Replying is the clearest signal, but opening an email that loads remote images can be enough, because the image request is logged against your address. The fake "unsubscribe" link in a spam message does the same thing, and it often leads to a page that asks you to confirm the address, which is exactly what the sender wanted.
Fix: Never interact with obvious spam. Delete it or mark it as junk, which trains your provider's filter. Turn off automatic image loading in your mail client so that opening a message does not phone home; tracking pixels are how that confirmation usually happens. Only use unsubscribe links in newsletters you genuinely signed up for.
3. Your address is public somewhere
Spammers run crawlers that harvest anything shaped like an email address from web pages: a personal site contact page, a forum signature, a GitHub commit, a conference speaker list, a PDF resume, a domain WHOIS record. If your address is written out in plain text anywhere a search engine can reach, it will be collected.
Fix: Search the web for your address in quotes and see where it turns up. Replace plain-text addresses on your own pages with a contact form, and ask forum or community admins to hide it from public profiles. For a domain you own, enable WHOIS privacy with your registrar. For any public-facing role, give out an address you are prepared to treat as a spam magnet rather than your main one.
4. A signup you forgot about shared your details
Sweepstakes, "free report" downloads, coupon sites, quiz pages, retail loyalty programmes and some apps include a line in their terms allowing them to pass your address to "partners". One signup can quietly fan out to dozens of senders over a few months. The giveaway is that the spam clusters around a theme: insurance offers, car warranties, loans, or whatever the original form was about.
Fix: For any sender that is a legitimate business rather than an outright scammer, use the unsubscribe link or reply STOP; real marketers are legally obliged to honour it in most countries. For future signups you do not trust, use a throwaway address so that the fan-out happens somewhere you never look. Our guide to avoiding spam covers which kinds of forms are worth an alias.
5. The address is short, common, or guessable
Spammers do not only buy lists. They also generate them. A dictionary attack sends to firstname@, firstname.lastname@, info@, sales@ and thousands of other patterns at every large domain, keeping whichever ones do not bounce. If your address is a common first name at a big provider, or a predictable role address on a company domain, you receive spam that nobody ever leaked. This kind of junk tends to be generic and arrives in bursts rather than clustering around a theme.
Fix: There is no way to remove a guessable address from a generator. Lean on filtering, and consider migrating important accounts to a less predictable address over time. For role addresses at a business, put a filter in front of them and never reply from them.
6. A newsletter list you were on was sold or compromised
Small newsletters change hands, get abandoned, or run on a mailing platform that is itself breached. When that happens, every subscriber starts receiving unrelated junk, often sent with the original newsletter's name as a disguise. If you and a friend who follow the same small publication both saw a spike at once, this is likely.
Fix: Block the sending domain, and if the mail is clearly not from the original publisher, report it as phishing rather than just spam, since it is impersonation. Subscribing to niche newsletters with a dedicated address makes this easy to cut off later.
7. Your own account is compromised
Sometimes the spam flood is incoming bounces. If a criminal is sending junk from your account, or spoofing your address as the sender, mail servers around the world return thousands of "undeliverable" notices to you. Look at the bounce messages: if they quote an email you never wrote, your address is being used, not just targeted.
Fix: Change your password immediately, enable two-factor authentication, and check your account's "sent" folder, forwarding rules and connected apps for anything you do not recognise. If the junk is only spoofed rather than sent from your account, there is less you can do beyond setting up SPF, DKIM and DMARC on a domain you own; on a consumer provider, it will subside as the spammer rotates to another victim.
8. Someone signed you up on purpose
"Subscription bombing" is when an attacker enters your address into hundreds of legitimate newsletter forms at once. The result is thousands of confirmation emails and welcome messages in a few hours, all from real companies. It is sometimes used to bury a real notification, such as a bank transfer confirmation or a password reset, inside the noise. If your spike is mostly welcome emails and double opt-in confirmations, treat it as a possible cover for fraud.
Fix: Before cleaning up, check your bank, payment apps and main accounts for activity you did not initiate. Then set a filter that moves anything containing "confirm your subscription" or "welcome" to a folder for the next week, and ignore it. Do not click confirm on any of them.
9. Your provider's filter changed, or you changed providers
Occasionally nothing about your address changed at all. Spam that used to be caught silently is suddenly reaching the inbox because a filter was retrained, you moved to a new mail app that does not use the server-side junk folder, or you set up forwarding that bypasses the first provider's filtering. Compare the volume in your junk folder with a month ago: if it dropped while the inbox rose, this is the explanation.
Fix: Make sure your mail client uses the provider's filtering rather than only its own. If you forward mail between accounts, filter at the destination as well. Marking fifteen or twenty junk messages as spam in a row usually retrains a consumer provider's filter within days.
Stopping the flood once you know the cause
Whatever the trigger, the same three habits reduce spam over time. First, mark junk as spam rather than deleting it, so your provider learns. Second, stop giving your main address to sites that only need it once; a disposable inbox for the signup, download or trial keeps the follow-up marketing away from the address you actually read. Third, review where your address is visible and replace it with a form or alias wherever you can. Spam volume rarely drops to zero, but with the cause identified and the address protected going forward, it goes back to being a nuisance rather than a flood.
If the junk is tied to one-off signups you do not want to repeat, a temporary inbox for the next one is the simplest way to stop the cycle restarting.