I have a linux box email server with Postfix as the MTA, Dovecot as the IMAP server and Apache with Roundcube as webmail.

In my /etc/postfix/aliases I have just above a hundred different aliases which makes as many email addresses on my domain. I use one address per website so I easily can shut down spam infested addresses.

During the half a year or so that I have had this setup, I have received 3 spam from 2 sources. As I know exactly where I entered this address, it should be easy to pinpoint email leaking websites and services.

**However**, these sources are, according to me, not likely email sellers. And for one of them to sell my email twice? I contacted one of the sources and they are adamant that their system is tight. They suggested the possibility that it is *my* server that is doing the leaking.

So, my question is:

```
How likely is it that my box is leaking email addresses, and how?
```

* I don't store fully qualified email addresses anywhere in my system except in my maildir.
* I use SSL connection to IMAP
* I *do not* use https on webmail