Old Email Sending Password Resets: 3 Fixes

1. Your Old Email Account Is Compromised (Most Common)

This is the reason nine times out of ten. Someone got into your old email account. They're using it to request password resets for your other accounts — bank, social media, email itself. The goal? Take over everything.

What you'll see: A flood of password reset emails from different sites. Each one's from the site's legit email. But they all show up within minutes or hours. Your old account's outbox might also show reset emails you didn't send.

How to fix it — step by step

1. Immediately change the password on the old email account. Use a device you trust (not the one you got the alerts on if you're unsure). Pick a long password — 16+ characters, random. A password manager helps. After you change it, you should see a confirmation email from the provider. If you don't, check your spam folder.
2. Turn on two-factor authentication (2FA). Use an authenticator app like Google Authenticator or Authy — avoid SMS if you can. After enabling 2FA, the provider will ask for a code from your app. Scan the QR code with your phone. Then try logging out and back in — you'll be prompted for the code.
3. Check for forwarding rules. Hackers often set up auto-forwarding so they see every email you get. On Gmail: Settings → Forwarding and POP/IMAP → check if any address is in the 'Forward a copy' box. If there's one you don't recognize, click 'Remove' and then 'Save Changes'. On Outlook.com: Settings → View all Outlook settings → Mail → Forwarding. Turn it off if it's on.
4. Sign out all other sessions. Gmail: scroll to the bottom of your inbox, click 'Details' (bottom right), then 'Sign out all other web sessions'. Outlook.com: Settings → View all Outlook settings → General → Privacy and data → 'Sign me out everywhere'. After doing this, you'll need to log in again on all your devices — that's expected.
5. Check account recovery options. Hackers swap your backup email or phone number. Gmail: Security → 'Recovery email' and 'Recovery phone'. Outlook.com: Security → 'Update info'. Make sure those are yours. If someone changed them, click 'Restore account' or contact support.

After you fix this: The password reset emails should stop within 24 hours. If they keep coming, move to the next cause.

2. Someone's Using Your Old Email for Two Types of Attacks

Your account might be secure now, but someone still has your email address. They're doing one of two things:

• Password reset spamming: They request resets for accounts they know you have — or guess you have. This floods your inbox with confirmations. It's annoying but harmless if your account is secure.
• Credential stuffing: They took your old password from a data breach and try it on other sites. If you reused passwords, some reset requests might be real — someone's trying to get in.

What to do about it

1. Check if your email was in a data breach. Go to haveibeenpwned.com. Enter your old email address. Look for results like 'LinkedIn 2012 breach' or 'Facebook 2019 breach'. If you see any, that's where the password came from.
2. Change passwords on all sites linked to that email. Focus on sites that had breaches first. Use unique passwords for each. Write them down in a notebook if you don't use a password manager — not in a digital file.
3. Set up login alerts. Most big sites let you get an email when someone logs in from a new device. Turn that on. For example, on Facebook: Settings & Privacy → Settings → Security and Login → 'Get alerts about unrecognized logins'. On Google: Security → 'Security checkup' — it'll walk you through.
4. Delete the old account if you can. Some providers let you close the account. Google: myaccount.google.com/delete-services-or-account. Outlook.com: Settings → 'Close account'. This stops all password reset requests because the email doesn't exist anymore. Downside: you lose everything tied to it.

3. A Third-Party App or Service Has Your Old Login Info

This is rare but happens. A service you signed up for years ago — a forum, a shopping site, a newsletter — still has your old email and password. Someone hacks that service, and your password gets leaked. The attacker then tries that combo on other sites.

How to find it: Look at the password reset emails. Are they from a specific site you forgot about? Like an old gaming forum or a retailer you used once? Check your email provider's 'Filtered mail' or 'Spam' folder — sometimes those end up there.

Fix it this way

1. Login to that old service. If you remember the site, go there and try to log in. Use the password you used back then. If it works, change it to a strong, unique password. Then delete your account if you don't need it anymore — look for 'Delete account' or 'Close account' in settings.
2. If you can't login, use the 'Forgot password' link. Reset it to something new. Then login and delete the account.
3. If the site is gone or you don't remember it, check your old email's sent folder. Look for 'Welcome' or 'Confirm your account' emails from around the time the resets started. That's your clue.

Quick-Reference Summary Table

Start with cause #1. It's the most common. If the resets stop, you're good. If not, move down the list. Don't wait — a compromised old email means someone's actively trying to steal your accounts.