Ok, so Discourse didn’t send them.
Your credentials were compromised but without more information we probably can’t say how or where.
Surely the logs at SES show recipients and the host which connected to send them?
This is the only stuff on there
