Mike thinks that his AOL account got hacked. Leo says the first thing to do is change his password. But even with that, chances are the account may not have been hacked, but spoofed. Spammers can pick up his email address and can use that in the return box. They swap them out from time to time, and chances are Mike's account email is on a list that spammers buy. The only thing he can do is wait for the spammer to move on to another email address.