When an online account's password is compromised, the hackers will sometimes sign the victim up for accounts on a ton of other online services. They hope that their actual nefarious activities are lost in the flood of confirmation emails. Mailchimp says this on the subject:
Sometimes, when an abuser attempts to takeover an account, they'll sign their target up for a several email lists at once. They hope that all the new emails in the target’s inbox will overwhelm them and distract them from malicious activity.
Dima Bekerman wrote a firsthand account of what that looks like. I've included the most relevant portions below, but the whole post is interesting and definitely worth a read.
I only noticed that something was odd when I opened Gmail one night and found hundreds of registration confirmations to numerous services I’d never heard of. What’s more, I was receiving a similar email every few seconds.
When most of the noise had been cleared, I found an Amazon email hidden among the junk. It informed me that my purchase—one I hadn’t made—would be delivered within 24 hours.
If your website sends a "Welcome" email to new accounts (and it probably should), it needs to prevent bots from signing up. Otherwise you might contribute to an inbox flood. This can even get you flagged by a blacklist operator like Spamhaus, as outlined by Brian Krebs, preventing your real customers from receiving emails from you.
Instead, follow this guidance from Dima's preventative tips:
- Filter registration bots – This tip is for site owners. Filtering registration bots can help prevent the attack described here, while also blocking any number of phony subscriptions to your service. This can be achieved by implementing Captcha as part of your registration process.