After the Yahoo breach, I was getting hacked e-mail from people there that obviously had my e-mail address in their contact address book. I routinely now always open any suspicious e-mail in Thunderbird's source view mode and look for anything suspicious including the source address in the header area. I also use Eset which scans all my IMAPS incoming e-mail. Additionally, no auto opening of e-mail attachments, all active content disabled. E-mail open in text mode only.