How is this spammer doing it?

Factual Questions
1

So, it appears to be from my mom’s yahoo.com email address, but it’s actually spoofed from a .cl domain. The addressees are a bunch of people I know via my mom–but then one of my old girlfriend’s addresses is in there too–a person whom I think she has never communicated with via email!?

So does this spammer piece of shit someone have ahold of both my mom’s info and mine somehow?

(The only thing I can think of that this ex may have been in my mom’s email inbox through a fwd or something at one point. I don’t see any other addresses from my address book except for one person that we both definitely know.)

Sigh. Thanks for your help.

2

Well my mom said she’d seen her in her contact list before, so I think that explains that part. Maybe just standard spoofing beyond that. Argh.

3

Still, if the addressees are people in your mom’s circle of contacts, then it’s not just spoofing: her contact list has been stolen. If she hasn’t already, she should change her Yahoo password now before the bad guys do.