I've received email confirmation from careers.stackoverflow.com that an application message--supposedly from me--has been received by an employer. The email confirmation went to one of my email addresses, but not one that I've used here. (It's my first name at a major email service, so it's an email address that a lot of people seem to get confused about, and they sign up for things, thinking it's theirs.)
My first thought was that it was an application from another stack overflow account, one that someone opened with the wrong email address. But when I check my own sent box on careers.stackoverflow.com, there's the message:
Dear Sir stroke Madam,
Fire, exclamation mark. Fire, exclamation mark. Help me, exclamation mark. 123 Carrendon Road.
Looking forward to hearing from you. All the best, Maurice Moss.
Um, apparently this is a character on The IT Crowd. And someone is sending fake emails as this character, which are somehow now attached to my stackoverflow account. Also, the employer ("Grindstone") isn't showing up in any searches, and I can't contact them through the message thread, because they haven't replied. With luck, they'll just dump it, but it's concerning.
There doesn't seem to be a stackexchange account associated with the email address where I got the confirmation--all attempts at using the stackoverflow "forgot my password" turn up with no accounts for that email address. Again, somehow this fake message has been associated with my stackoverflow account.
I've already changed my stackexchange password, but this whole episode suggests that there's some systemic vulnerability.
Is there anyone on staff who can look into this with me?
Update: I did find the employer in question--in Australia, and careers.stackoverflow.com tells me in bold green type at the top of the listing that I applied on July 29. I did not.
Explanation: Option 1 of Martijn's answer, based on our discussion, looks like the best explanation.
Bug: If someone clicks a link in an email that was sent to an email address that isn't yet associated with their SO account, that email address will automatically become associated. This could, theoretically, be used to insert sent messages from someone's SO account without their consent, and without knowing their password. (Though the attacker would have to know that their target has an SO account, and has an email address not yet associated with SO.)