An email you haven't even looked at yet could be used to trick your mail server into helping crooks to logon as you.