I like how the code has Javadoc comments, in case other developers need to maintain the worm or use its public API.

That's gotta be a copy-paste job. If someone was actually cheeky enough to comment their malware they would've left jokes, puns, etc.

Indeed, those comments come from a Google Analytics quick start: https://github.com/chriskwan/gmailytics/blob/master/quicksta...

Copy/pasted from this Stack Overflow answer: http://stackoverflow.com/a/37342136/300887

Sending everything to this mailinator address which oddly seems to be empty:

https://www.mailinator.com/inbox2.jsp?public_to=hhhhhhhhhhhh...

Maybe Mailinator has purged the box and is rejecting mail from it. Good on them.

Please correct me if I'm wrong, but I don't think anything was being sent to that mailinator address.

From looking at both that source code and emails received by my users, the mailinator address seems to be only in the message header "to" field, which, AFAIK, doesn't do anything other than display in the mail client.

The actual recipient's address is in the envelope recipient field.

I don't understand what the purpose of that mailinator address was.

It sends an email to that mailinator address, with all of the contacts BCC'd. mailinator shut it down very quickly but emails definitely went to that address.

They even used Google analytics! UA-98290545-1

Where'd you get this?