Unfortunately, I believe that Fastmail leaks existing inboxes, and is theoretically vulnerable to brute-force scraping. However, that seems pretty unlikely in

Unfortunately, I believe that Fastmail leaks existing inboxes, and is theoretically vulnerable to brute-force scraping. However, that seems pretty unlikely in my case. If someone was enumerating the Fastmail address space, then I would have needed to receive a "probe" email to that address first, and I don't recall receiving anything except communications from Comcast itself (and this is a low-volume inbox where I read every email). Alternatively, that could have been the spammer's probe email - except that I emailed several of the other addresses on the recipient list, and none of those emails bounced, and I got several responses from real humans. So either the spammers had a long list of addresses that they knew and were only probing mine (which seems far-fetched) or they just happened to guess both my address and every one of the others that I emailed (which seems incredibly unlikely). Unless there's something else that I'm missing...