FWIW, I checked the unique address I gave to CAG at haveibeenpwned.com to receive the report that I have been pwned: Since CAG is the only site that I've given this address, I strongly suspect that CAG is the breached site. Also FWIW, I give unique addresses to each organisation that wants my email address. Unique addresses that have attracted the current run of p**n spam are associated with LastFM (3 breached sites, no pastes but some of the spam quotes the password I used when I last visited lastfm several years ago) and AVAST anti-virus (2 breached sites, no pastes). I'm really shocked at the last of those. Edited to add: BTW, the addresses that I give organisations comprise of a prefix, a delimiter, and a suffix -- the prefix denotes the type of organisation, the delimiter is a non alphanumeric character and the suffix uniquely identifies the organisation when looked up in a table of addresses that I keep. So 'dictionary' attacks (such as every name possible @domain) will not work, which implies beyond reasonable doubt that these addresses have been harvested during one or more breaches.

Thanks. I was wondering after I received an 'offer' of a work-from-home job 'testing' a gambling system for a salary of £5,000 per month pre-bonus! I can confirm that I've only used the email address to which that spam was sent to sign up to CAG. (FWIW, I generate a unique address to give to each website that requires my email address.)

My son got ripped off by the system some years ago. His college tutor advised him to redo year 2 of his course. So he took the advice, didn't complete the last few weeks of year 2, and intended to restart that year the following Sept (2007). However, the college converted into a university in the meantime and he was told during the Summer holidays that he couldn't retake year 2 as planned. He appealed and was told he could return at the end of the school year to retake only the bit he'd missed. The Student Loan Company (SLC) deemed that would amount to part-time education and so he would not be entitled to continue his student loan. Without the loan, he couldn't continue and so was forced to drop out. SLC then deemed that he'd intentionally dropped out and so was liable to repay the loan in full. I suspect that the SLC decision is perverse, but that's not the point of my post. Since leaving full-time education, he hasn't earned enough to take him over the payment threshold. He's now emigrated to Australia and set up his own business that's making insufficient profit to take him over the payment threshold. Unfortunately, SLC are demanding that evidence of his income be verified by an accountant or lawyer, which would incur significant professional fees. I have to ask why a copy of his tax return to the ATO would not be adequate and whether SLC have the right to demand that my son, effectively, spends a large proportion (more than he can afford) of his income on having his accounts professionally verified/audited when the only reason for doing so is SLC's demand? All help gratefully received.