drafts
We generate a unique "one time use" e-mail address. Nobody knows what it is except us.
store
We go to a random website and fill out a form to make an account, download a file, request more information, etc.
move_to_inbox
The company sends us e-mails. We use automated tools to keep track of them.
gavel
If that e-mail address receives messages from other people, it means our "one time use" address was leaked or sold.
report
We find links in the e-mail and compare them against a database of websites known to phish or spread malware.