iPhone user is receiving text-to-email from another person using their phone number. How to trace?

The user received a legitimate email with a return address using their text mail address. However they didn't send the email, they only received it.  The sending address is their phone number @ mms.att.net
The user has an iPhone, an iPad and an iMac.  The email was received on the iPhone and iPad, but not on the iMac.  

Is there a way to see the header on an email received on an iPhone or iPad?

They have since called AT&T and made sure that they don't share their phone number account with anybody else.
ATT told them that they also share a satellite TV account with another person, but that this other person is the only control for the shared account.

The user changed their iCloud password, and confirmed that they have 2-factor authentication turned on.

My guess is that their phone number is embedded in the Mac Messages app on some computer somewhere, and that when a file was 'shared' the Messages app sent the file using a wrong phone number.

Naturally, they don't want people sending out email using their AT&T phone number

Any idea how this return address appeared?

Thanks.


email with text mail address
computerlarryAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

serialbandCommented:
What kind of account was used to receive the email?  If you don't have it on a computer, then you won't get the email headers easily.  Also, even if you're able to see the email header, it may not help you if it's been spoofed.
computerlarryAuthor Commented:
The user received this from gmail, and used the Apple Mail program to download email.
serialbandCommented:
Since it's gmail, log on to the web portal to see if the mail is there.
computerlarryAuthor Commented:
The users says that this message doesn't appear on their computer's gmail, either in inbox or junk.  

I have since found out that the message was sent from an iPhone using Messaging.

The return address is what I can't figure out.  I had the sender check their Messaging app on the iPhone, and the recipient's phone number wasn't listed as a sending account on the iPhone.

Could something on the recipient side of things have done some forwarding or redirection?
serialbandCommented:
Recipient and sender header information can be spoofed.  If it's a text message, they can also come through a web portal.  I used to use the AT&T web page to send SMS to family when my phone ran out of power.  I couldn't receive, but I could send.  Email and text have always been insecure,

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
iPad

From novice to tech pro — start learning today.