A user's iPad shows a message sent but the user did reply or respond to the email received, and did not send a reply back to sender.
The user believes that someone accessed their Yahoo mail account, sent a reply, and signed sent message from the user's iPad.
Can this be traced to find out who sent and accessed the user's Yahoo account? The user believes it was another family member, but would like to have visual proof.
What steps can I take?
There are no steps you can take because you don't have access to the server logs at Yahoo! If this is a legal matter, you might be able to obtain a search warrant for the mail server logs if law enforcement is involved. This would only prove where the connection was established from, which may or may not be useful.
In the meantime, have the owner of the Yahoo! account change their password to something stronger and ensure they don't leave their iPad or any other device logged in where somebody else can access it.
The fact that you receive a message from [email protected] isn't a proof that this message is originating from bob nor yahoo.com.
For example [email protected] may send you a message with a header
saying From: Bob <[email protected]>.
Hence it can't be a proof that the bob account was illegally used.
To check that a message is really coming from [email protected] just look at the full headers of the suspect message and check its origin. You'll clearly see its origin within the last Received: line.
This line and the nearby ones may also provide you the IP address of the client who submitted the message and the account really used at yahoo.
