Telecommunications Users Association chief executive Paul Brislen said a solution was in sight but Xtra email customers should expect ''months and months'' of breaches before the problem was fixed.
On Friday, Telecom said it would continue to offer its Yahoo! Xtra email service with Yahoo as its email provider. The decision was made after a review of the email.
Yesterday, after some complaints to the Otago Daily Times, Telecom said it had begun urgent investigations with Yahoo to identify the source of the latest issues.
That included submitting examples of the suspicious emails for Yahoo to analyse.
''Based on this analysis, Yahoo implemented some additional security protocols, which it has in place for incidents just as this.''
Telecom had been given a preliminary assessment of the number of ''compromised'' accounts - the ones misused to send suspicious emails.
On any normal day, the number of compromised accounts could range from fewer than a hundred to 1000 or more, Telecom said.
In the latest incident, the number appeared to be at the higher end of the normal range.
The compromised customers would be required to change their passwords. Details on how to do that are on www.telecom.co.nz/changepassword.
''It is important for customers to realise that simply receiving a suspicious email does not indicate their account has been compromised. We're advising customers who have received mail they believe is spam, even from a known contact, to delete it immediately and never to click on suspicious links contained within the emails,'' a Telecom spokeswoman said.
Mr Brislen understood Yahoo treated the Xtra email differently from its standard email service but the Xtra email would be migrated across to provide tighter security and full support.
It was clear the spammers did not access every Yahoo! Xtra account in February and were now working their way through the unprotected accounts.
''Potentially, it's not even the same breach or the same accounts. There is a solution but the waiting will be tough. We are in for months and months of this.''
BT, in Britain, was having similar attacks on its email, Mr Brislen said.
Telecom retail chief executive Chris Quin said customers put a lot of value on the Yahoo! Xtra email service. Many had used an Xtra address for many years and saw it as part of their online identity.
''We looked seriously at whether we should continue offering an email service at all, and the overwhelming feedback from our customers was that we should.''
All email providers were continuously battling online crime and spam. Yahoo alone blocked more than 600 billion spam messages a month.
More than 200,000 Xtra customers had changed their passwords, he said.
In an unrelated matter, some customers with Apple devices had had problems syncing their Yahoo! Xtra accounts. Telecom believed the issue had been resolved but customers might need to restart their devices for the syncing to occur, Mr Quin said.
