Looking around on the internet, I see reports starting two weeks ago about people receiving spam from a Yahoo email address with From: <a relative> and the Subject: for <firstname>.

Delving into my Facebook privacy settings, I saw "Who can look you up using the email address or phone number you provided?" was set to Everyone. Hmmm.

I logged into a Facebook account that is not friends with my father, I searched on his email address, found his profile, and was able to his friend list.

Spammers must be doing the same thing - searching email addresses, going to the page, and, if the friend list is public, sending the spoofed emails. It seems to be choosing relatives or people with the same last name for the spoofed "From" name.

It's time once again to check and update your Facebook privacy settings.