"Don't try to convince them you're innocent." Why?

"That suggests they have records of device identifiers" It may help to know that emails include data about the sending IP (the one that talked to the mail server). I.e. I don't see any reason to think that they identified the device. They probably just identified the IP. If it's the IP that the IP normally uses to send emails, that's sufficient. I mean, other devices on the home network could be cracked and send from the same IP. But that would establish that either the mail server was hacked or the OP's home network.

@GregoryCurrie: Because it’s not about innocence but about a security issue. You shouldn’t have to prove or insist on your innocence, just state “I didn’t send those mails, looks like we have a security issue” should be enough.

@GregoryCurrie - Because that's what guilty people do - and people who are more concerned with the effect it's having on them than the effect things could be having on the company. Most managers know that while it might be reasonable for them to distrust their staff, it wouldn't be good practice to ignore the possibility of a security breach. There's an open door there that's worth pushing.

@Michael I think that's a very blasé way of looking at it. The OP is facing the prospect of being fired. The OP has already told their boss, and that wasn't enough. In a perfect world, yes, the boss would just believe the OP and they could both work together to resolve this issue. If the boss actually cared about security's he first thing he would have done is quarantine the machine in question.

@mdfst13 - I wanted to avoid getting too much into the technical stuff. An IP might go partway (if it clearly wasn't the IP the OP uses) , but since many home hubs have wifi of varying range and levels of security, locating the hub might not go all the way to demonstrating it was someone in the house - or a specific device.

@ItWasLikeThatWhenIGotHere Correlation is not causation. Just because guilty people plead they are innocent doesn't mean everyone who pleads they are innocent are guilty.

@GregoryCurrie - I can't argue with your logic, but I'm not seeing the relevance to what I wrote. Not what I said.

@ItWasLikeThatWhenIGotHere You state that guilty people plead their innocence, so the OP shouldn't do that.

@GregoryCurrie are you purposely missing their point!? They say don't waste energy convincing anyone of your innocence because you don't need to: If it gets out that you found a security flaw, everyone will KNOW you're innocent. Something that you can never achieve with convincing.

@Hobbamok It's unlikely the OP will be given enough scope in order to uncover the flaw, even if they had the expertise in order to do so.

@GregoryCurrie but it will give you an actual argument. Otherwise all you can say is "it's not me, I'd never do that" but nobody believes you, because HOW ELSE did that email come from your account? Everyone thinks it's a bad cope.

@Hobbamok I don't know what a bad cope is. I agree that articulating that there could be some sort of security issue is important. But putting all your eggs into the basket of hoping you can find a hole, is likely to be fruitless.

Honestly, I'm surprised that the company isn't more interested in the potential security breach than in the offence caused by the contents of the email. I once received a rather rude email from a student; we all had a laugh about it in the office, and then I replied to say please take more care not to let other people use your email account. My advice to OP would be, don't treat this as "I've done nothing wrong", consider whether you have done something that might have enabled a security breach, and take responsibility for that mistake if you did make one.

@ItWasLikeThatWhenIGotHere "that's what guilty people do" It's also what innocent people do.

The "security problem" is likely an "I forgot to lock my computer" problem.

@GregoryCurrie "Correlation is not causation. Just because guilty people plead they are innocent doesn't mean everyone who pleads they are innocent are guilty." Logically, you are correct. However, in the court of HR/the manager's private opinions, inferring causation from correlation is statistically likely to happen.

@user76284 - you mean like the rest of that sentence says? The OP has a choice whether to be the person looking at individual injustice, or the person who spotted a security problem. Whichever way things turn out, the second approach is likely to have a better outcome for both the individual and the company.

@ItWasLikeThatWhenIGotHere That's not what the rest of the sentence says.

@user76284 - Can you give me a hint what you're trying to achieve here that might help the OP? I'm having trouble differentiating that from just using selective quotes to pick an argument. If you have a way where looking mainly at innocence might be more useful than concentrating on the security aspects, or an instance where concentrating on the security aspects might be less effective, I'd upvote that as a useful alternative answer.

@ItWasLikeThatWhenIGotHere I'm just saying that arguing innocence is not evidence of guilt. Perhaps the comment could be clarified by saying "Because that's what guilty people also do", if that was the intended meaning. That aside, convincing their boss that they're innocent would of course be helpful to the OP.

@user76284 - I had thought that saying "...and people who..." would work the same way as an "also". Maybe leading with the "also" would have given more weight to the idea that I didn't think the OP was one of the first group. I'll bear that in mind next time. Thanks for your thoughts.