Spam Is Not a Breach: Which Gmail Problem Do You Have?
Junk mail after public Wi-Fi does not prove a compromise. Run the spam controls and the account audit as separate tracks, and know which evidence counts.
The spam started after you used a cafe's Wi-Fi, so the hotspot must have leaked your Gmail password. That conclusion skips a step. Incoming junk and unauthorized access are different events, and one does not imply the other.
Two response tracks exist, and choosing the wrong one wastes the afternoon you could spend checking whether anything actually happened.
Two events people merge into one
Spam is mail someone sent to your address. Account compromise is someone else holding credentials or a live session. The first needs an address, which is not a secret. The second leaves traces in security events, devices, forwarding rules and sent mail. Timing can suggest a connection between them, but it cannot establish one.
Treat the timing as a reason to look, not as the finding itself.
Track one: reduce the unwanted mail
Use Gmail's own spam and phishing controls on junk you never asked for; replying, or following a removal link you do not recognize, is how people confirm a live address. Google's spam guidance separates reporting unwanted mail from unsubscribing to something you deliberately signed up for. For a newsletter you recognize, use its own unsubscribe mechanism.
Branding is easy to copy, so an unsubscribe link inside a message that impersonates a company is not automatically safe.
The built-in report also sends a copy for analysis, which is another reason to use the button rather than forwarding your whole inbox to a helper. It is also worth knowing what this track cannot do: reporting does not revoke a session or delete a forwarding rule.
Track two: audit the account
Reach the account from the official app or by typing the address yourself, never from a link inside the suspicious mail. Google's compromised-account guidance points at concrete evidence: recent security events and unrecognized devices, sent messages you did not write, and unfamiliar forwarding, delegation or filter changes. Read those entries carefully. A different IP-location label is a hint, not proof of intrusion.
If you find activity that was not yours, follow the supported recovery and securing steps. If sign-in fails, the official recovery flow is the only safe route; a third-party support contact who asks for credentials is not. No legitimate support process needs your password or a one-time code.
The flood that hides something
A sudden wave of subscription confirmations deserves more attention than the individual messages. The same guidance notes that a flood is a useful place to hide a real security notice.
Check account-change notifications through trusted entry points while you keep reporting the unwanted mail. The flood itself still does not tell you how, or whether, anyone accessed the account.
What a VPN does and does not change
A VPN protects the path it carries and little else. It does not remove your address from a mailing list, undo a phishing submission, or uninstall software already watching the device. Turning one on after the fact is not remediation.
It will not remove an unfamiliar forwarding rule either. If you find one, treat it as an account-security event and work through the account track.
Match what you see to the track:
| What you see | Which track |
|---|---|
| Unwanted mail, no account changes | Spam controls |
| Unknown device or session | Account security |
| Unfamiliar forwarding rule | Account security, urgently |
| Spam plus an account-change alert | Account security first, then spam controls |