An interesting point that might help with this problem.
Last year I added a new entry to my addressbook and then immediately shut down my computer and left town. About two hours later I received a phone call from that person last added and he had received an e-mail with the usual viagra ad. Of course, many others in my addressbook--possibly all of them--received the embarrasing e-mail, also.
I use ATT.net (Yahoo) webmail, and I assume, since it is now on my smartphone as well as my two computers and anywhere else I log on, that the addressbook is actually kept on the ATT server - or both there and on my devices? I have no idea. I have had multiple attacks, have changed my password each time, and eventually ATT started requiring a new sign-in every two weeks.