I figured I'd throw this out there.
I'm cautious with my online presence. I don't do social media and I limit my website registrations.
I started receiving thousands of spam e-mails this morning....and I mean thousands. I got over 3500 in the space of 10 minutes. I was suspicious of this activity and looked at the e-mail they were sent to. I have nothing important on that e-mail, it's just a general use e-mail, but I remembered that my PayPal account was on that e-mail. It was an older account and I rarely used it so it escaped my notice. I had not turned on 2 step notification.
Turns out, someone managed to hack the password to the account and sent themselves a large sum of money. The e-mail spam was to cover up the e-mail from PayPal that tells you that you just made a transaction. I mean, who will check out 3000+ emails. Disputed it, and not worried about it being returned to me.
PSA - make sure you have 2 step authentification if available, and if you ever get an email storm, check out your accounts, including PayPal, Amazon (and other online retailers), and any such accounts that are associated with the email being spammed and that have any direct or indirect interaction with your money.
Just throwing this out there so no one gets caught by these scamming / hacking bastiches.