A colleague at work mentioned that he got one of those mail administrator returned mail emails about an email that he never sent. I told him to just change his account password, although he's convinced there's actually a hacker trying to use his email account. Is there any basis to his fears and does he need to wipe his entire system and start again with the same account password as he seems to think? What should I suggest he do?