Usually this happens either on a email account password compromise or else it might be a spoofed email.
First of all you may ask a detailed header of the spam or spoofed email to your provider for detailed investigation of the origin of the spam.
If it is a spamming case you can request for a server logs also, for email spoofing there are less chances of trace of logs written in the server.
In the case of password compromise,
- Immediately reset the email password to a stronger one.
- As an additional security measure for prevention, reset control panel and FTP password of your account to stronger ones.
- Always try to login to your email account and FTP accounts from a malware free computer of device. Always ensure your local device is not infected with malware. Scan the devices using any advanced malware/virus scanning software.
- Dont update your email account credentials in any public forums to avoid further issue.
In the case email spoofing
- Enable a valid SPF and DKIM authentication for your domain to avoid spoofing.
Also you can implement any spam filter software's to filters emails or you may purchase email spam filtering services from mailchannels, mailchip etc.
Spamassasin is one of the free softwares.
